6 karma · joined June 6, 2012
<code> <?php 02 03 define('CRONJOB', TRUE); 04 include("index.php"); 05 06 $email = isset($_GET['email']) ? $_GET['email'] : ""; 07 $hash = md5("carbon".$email); 08 setcookie("guid", $hash, time() + (10 * 365 * 24 * 60 * 60), "/", "carbonhire.com"); 09 //print_r($_COOKIE); 10 header("Location: http://hastrk1.com/serve?action=click&publisher_id=59998&sit..., true, 302); 11 12 $link = mysql_connect('geniushire-real-1.cbuqrrbjabbr.us-east-1.rds.amazonaws.com', 'geniushire', ';kcvGayqe05t4!?'); 13 if (!$link) { 14 die('Could not connect: ' . mysql_error()); 15 } 16 17 mysql_select_db("geniushire_real_new", $link) or die('Could not select database.');$sql = "UPDATE gh_central SET cookie_id = '".$hash."' WHERE email = '".$email."'"; 18 if($email != ""){ 19 $sql = "UPDATE gh_central SET cookie_id = '".$hash."' WHERE email = '".$email."'"; 20 $r = mysql_query($sql); 21 } 22 ?>
</code>
Some how in settings, we had flag "Store Credit Card Info" as "Plain Text" enabled. The Admin/Staff of that client could have use this information to make transactions (As in Backend it would show Full CC info into order details)
We didnt realized untill we worked on it again for some bug fixes and adding new features.
Lesson Learned :- When transitioning from DEV to PROD env, make sure to check all these critical flags and correctly set
Luckily, the client didnt had any idea about what was wrong in backend.
There is no exception. I doubt even if they read application before clicking on "Delete" button.