I have a website hosted on an Apache Tomcat 7 server that uses the Authorize.net gateway and merchant services to handle payment. I recently ran a required PCI Compliance test against my website, and it failed due to a Reflected Cross-Site Scripting (XSS) Vulnerability. The example they gave was to replace the value of one of my form parameters with a script: alert('test')
I feel that I have already addressed this issue on the client-side by validating inputs when the form is submitted, and not proceeding if one of the inputs is invalid. However, a re-scan recently failed, so I think I need to do more.
My first question: is it possible to pass POST parameters to the server via the URL? I thought this was only possible with GET method, which I don't utilize. What I'm trying to figure out is how they are submitting this data. Their support is non-existent, of course, so I have to figure out the issue on my own.
Has anyone had any experience with PCI RapidComply? What did you use to fix your XSS Validation issues?