Collected research
Temenos OFS Field Injection: Revealing a Hidden Financial Attack Vector
An instant payment API concatenated user input straight into Temenos T24 OFS command strings, so a comma lets an attacker append extra fields to the funds-transfer request. Overriding the debit account number takes the money from a victim's account, and setting a future processing date credits the recipient with no deduction from the sender at all.
Record
- Researcher
- Omar Elshopky (3l5h0pky)
- Published by
- Medium
- Date
- Topic
- Injection
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Omar Elshopky (3l5h0pky), first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .