# The Bug That Kept On Giving :: PaymentBypass :: Eposed Return Url

Gift card shop trusted the payment provider's return_url in the status JSON instead of verifying payment, letting attackers hit complete.shtml to mark unpaid orders paid.

- Payout: unconfirmed
- Severity: high
- Program: -
- Credited: g30rgy th3 d4rk
- Disclosed: 2022-04-05
- Write-up quality: 6/10
- Original: https://crypt0g30rgy.github.io/post/PaymentBypassThree
- Library page: https://bugbountylibrary.com/r/blog%3Acrypt0g30rgy-github-io-post-paymentbypassthree
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog sev:high tech:rest technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** gifts.jij0.be checkout / payment status API
**Root cause:** Backend never verified the order was actually paid; it relied on the payment provider's return_url from the status JSON response to confirm success.
**Steps:**
1. Visit gifts.jij0.be, select ticket, fill cart, choose QR payment, get QR
2. Intercept `GET /v1/status?authorisation=[id]&transaction=[id]` with empty body in Burp
3. Intercept the JSON response containing `Response[0].IssuerTransaction.return_url`
4. Extract `return_url` = `https://gifts.jij0.be/complete.shtml?sessionId=id&pspEchoData=[data]`
5. Request that return_url directly without paying; observe green payment-complete check
6. Wait for email confirmation of purchase
**How found:** Followed the QR payment flow and noticed the status response leaked the onSuccess return_url, hypothesizing the backend trusted it rather than verifying payment via webhook.
**Exploitation:** Attacker starts an unpaid QR order, intercepts the status response, extracts the return_url, and visits it directly to trigger the success flow, obtaining the gift card without payment.
**Insight:** In payment flows, watch for the provider's success/return URL appearing in client-visible JSON; if the merchant redirects to it without server-side webhook verification, replaying it fakes payment.