| Package | Affected versions | Patched versions |
|---|---|---|
| php toolkit | ≤ 0.50 |
Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free