php - Prestashop 1.6 Amount Tampering While Check Out


I have a shopping cart built in Prestashop 1.6 and I have integrated HDFC Payment Gateway in it . After an security audit the bank told me "The test found one high-risk vulnerability (i.e. Amount Tampering)". Resolution- Kindly maintain the session.

I had not coded anything as Prestashop 1.6 is in built CMS and neither did i do anything with the HDFC payment gateway as they provided a pre built code from their end which is developed using Prestashop 1.6. I just installed the module from backend.

The Problem

  1. Added one item to the cart and checked out. (eg - 400 USD)
  2. On the 3rd party hdfc payment gateway page i didn't process with the payment.
  3. Opened another tab and added few more items (eg - 400 USD + 300 USD)
  4. Now back to point 2 and i processed with the amount for 400 USD and paid.
  5. In my admin panel its showing paid for 400 USD + 300 USD and two items are bought by the customer .

I have no idea how to solve this Amount related issue.

I am a newbie in Prestashop and Payment Gateway Integration.




The best practice with payment processing is always to double-check that the amount sent back by the bank after the payment was processed is perfectly matching with the amount of the related shopping cart in your local (PrestaShop) database.

Here's a simplified flow chart:

PrestaShop / HDFC flow chart

In case you do not have programming skills, I would suggest to kindly refer to the module's developer so he/she can address that security issue.

People are also looking for solutions to the problem: jquery - how to get two values to get result in php and ajax


Didn't find the answer?

Our community is visited by hundreds of web development professionals every day. Ask your question and get a quick answer for free.

Ask a Question

Write quick answer

Do you know the answer to this question? Write a quick response to it. With your help, we will make our community stronger.

Similar questions

Find the answer in similar questions on our website.