Back to the archive
    ARC-003CONFIDENCIAL · AnonimizadoCRÍTICO

    Threat framework on an e-commerce platform with payment gateway

    Structured analysis of 14 threats on a B2C online store (500–2,000 orders/month, 15,000 records). Four critical ones concentrated in payment fraud, checkout injection, card-data exfiltration and identity spoofing. Significant exposure to PCI DSS v4.0 and GDPR.

    Analysis type
    Threat modeling · STRIDE + OWASP
    Sector
    E-commerce B2C · WooCommerce
    Status
    Closed
    Date
    2025
    STRIDEOWASPMagecartPCI DSSRGPDSQLiIDORDDoS
    01

    Context

    • ·Partially up-to-date WooCommerce on WordPress, 25+ active plugins.
    • ·External payment gateway via iframe + basic tokenisation, shared hosting + CDN.
    • ·No customer MFA; third-party integrations (GA, Pixel, marketing) on the attack surface.
    02

    Methodology

    • ·STRIDE (Spoofing · Tampering · Repudiation · Info Disclosure · DoS · Elevation).
    • ·OWASP Top 10 e-commerce as sector filter.
    • ·Probability × Impact risk matrix; mitigation plan by horizon (0–30 / 1–3m / 3–6m).
    03

    Findings

    01AME-001 · Magecart / JS skimming
    CRÍTICO
    02AME-002 · SQLi in search/API parameters
    CRÍTICO
    03AME-004 · Chargeback fraud without robust logs
    ALTO
    04AME-005 · Outdated plugins (supply chain)
    ALTO
    05AME-006 · Volumetric DDoS on checkout
    MEDIO
    06AME-007 · IDOR on order access
    MEDIO
    04

    Operational impact

    • ·Direct financial fraud + PCI DSS v4.0 breach (fines and possible payment-operations halt).
    • ·GDPR risk: up to €20M or 4% of global annual turnover.
    • ·Best cost/benefit control: CSP + SRI on checkout scripts (immediate Magecart mitigation).
    05

    Full document

    RESTRICTED ACCESS
    12 pp· 84 KB· PDF

    Document from the private archive

    This report is part of Zero101OSINT's private research archive. Access is individual, logged and traceable. No spam, no mailing list.

    Basic privacy information. Project: Zero101OSINT. Legal identity of the controller: pending owner confirmation. Manage the requested document and record the access request.

    Technology and email providers may process the submitted data. Legal basis, retention periods and international transfer arrangements remain pending owner confirmation. This request does not authorize advertising.

    Rights: access, rectification, erasure, objection, restriction and portability, where applicable. Contact: contacto@zero101osint.com. Privacy policy.

    PDF delivered through a temporary signed URL. The access request is recorded.