{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,7]],"date-time":"2026-05-07T15:51:50Z","timestamp":1778169110795,"version":"3.51.4"},"publisher-location":"New York, NY, USA","reference-count":36,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,4,30]],"date-time":"2023-04-30T00:00:00Z","timestamp":1682812800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,4,30]]},"DOI":"10.1145\/3543507.3583319","type":"proceedings-article","created":{"date-parts":[[2023,4,26]],"date-time":"2023-04-26T23:30:25Z","timestamp":1682551825000},"page":"2144-2154","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["All Your Shops Are Belong to Us: Security Weaknesses in E-commerce Platforms"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1692-2486","authenticated-orcid":false,"given":"Rohan","family":"Pagey","sequence":"first","affiliation":[{"name":"Concordia Institute for Information Systems Engineering, Concordia University, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9630-5858","authenticated-orcid":false,"given":"Mohammad","family":"Mannan","sequence":"additional","affiliation":[{"name":"Concordia Institute for Information Systems Engineering, Concordia University, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4284-8646","authenticated-orcid":false,"given":"Amr","family":"Youssef","sequence":"additional","affiliation":[{"name":"Concordia Institute for Information Systems Engineering, Concordia University, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2023,4,30]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"[n.d.]. Cross Site Scripting (XSS). https:\/\/owasp.org\/www-community\/attacks\/xss\/."},{"key":"e_1_3_2_1_2_1","unstructured":"Barn2.com. [n.d.]. How many websites use WooCommerce?https:\/\/barn2.com\/woocommerce-stats\/."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00045"},{"key":"e_1_3_2_1_4_1","volume-title":"Shopify Revenue and Merchant Statistics","author":"Dean Brian","year":"2022","unstructured":"Brian Dean. [n.d.]. Shopify Revenue and Merchant Statistics in 2022. https:\/\/backlinko.com\/shopify-stores."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417869"},{"key":"e_1_3_2_1_6_1","unstructured":"Dolev Farhi. [n.d.]. GraphQL Security Auditor. https:\/\/github.com\/dolevf\/graphql-cop."},{"key":"e_1_3_2_1_7_1","unstructured":"Folio3.com. [n.d.]. Growing popularity for SaaS e-commerce platforms. https:\/\/ecommerce.folio3.com\/blog\/ecommerce-saas-platforms\/."},{"key":"e_1_3_2_1_8_1","unstructured":"Christophe Gagnier. [n.d.]. Cookie-Editor. https:\/\/cookie-editor.cgagnier.ca\/."},{"key":"e_1_3_2_1_9_1","volume-title":"Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments. In IEEE Symposium on Security and Privacy.","author":"Ghasemisharif Mohammad","year":"2022","unstructured":"Mohammad Ghasemisharif, Chris Kanich, and Jason Polakis. 2022. Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments. In IEEE Symposium on Security and Privacy."},{"key":"e_1_3_2_1_10_1","volume-title":"The State of Security Within e-Commerce","year":"2021","unstructured":"Imperva. [n.d.]. The State of Security Within e-Commerce 2021. https:\/\/www.imperva.com\/resources\/reports\/TheState_ofSecurityWithin_eCommerce2021_report.pdf."},{"key":"e_1_3_2_1_11_1","unstructured":"Binny Joseph. [n.d.]. 5 reasons of growing popularity of SaaS e-commerce platforms. https:\/\/www.linkedin.com\/pulse\/5-reasons-growing-popularity-saas-ecommerce-platforms-binny-joseph\/."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3471621.3471846"},{"key":"e_1_3_2_1_13_1","volume-title":"Messy States of Wiring: Vulnerabilities in Emerging Personal Payment Systems. In 30th USENIX Security Symposium (USENIX Security 21)","author":"Lou Jiadong","year":"2021","unstructured":"Jiadong Lou, Xu Yuan, and Ning Zhang. 2021. Messy States of Wiring: Vulnerabilities in Emerging Personal Payment Systems. In 30th USENIX Security Symposium (USENIX Security 21)."},{"key":"e_1_3_2_1_14_1","unstructured":"Justin Moore. [n.d.]. AutoRepeater: Automated HTTP Request Repeating With Burp Suite. https:\/\/github.com\/nccgroup\/AutoRepeater."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"crossref","unstructured":"Collin Mulliner William Robertson and Engin Kirda. 2014. VirtualSwindle: An automated attack against in-app billing on Android. In ACM ASIA CCS\u201914. Kyoto Japan.","DOI":"10.1145\/2590296.2590335"},{"key":"e_1_3_2_1_16_1","volume-title":"API top 10 -","author":"OWASP.","year":"2019","unstructured":"OWASP. [n.d.]. API top 10 - 2019. https:\/\/owasp.org\/www-project-api-security\/."},{"key":"e_1_3_2_1_17_1","unstructured":"OWASP. [n.d.]. Session Fixation. https:\/\/owasp.org\/www-community\/attacks\/Session_fixation."},{"key":"e_1_3_2_1_18_1","unstructured":"OWASP. [n.d.]. Testing for Cross-site Request Forgery. https:\/\/owasp.org\/www-project-web-security-testing-guide\/latest\/4-Web_Application_Security_Testing\/06-Session_Management_Testing\/05-Testing_for_Cross_Site_Request_Forgery."},{"key":"e_1_3_2_1_19_1","unstructured":"OWASP. [n.d.]. Testing GraphQL. https:\/\/owasp.org\/www-project-web-security-testing-guide\/latest\/4-Web_Application_Security_Testing\/12-API_Testing\/01-Testing_GraphQL."},{"key":"e_1_3_2_1_20_1","volume-title":"Toward Black-Box Detection of Logic Flaws in Web Applications. In Network and Distributed System Security Symposium (NDSS\u201914)","author":"Pellegrino G.","unstructured":"G. Pellegrino and D. Balzarotti. 2014. Toward Black-Box Detection of Logic Flaws in Web Applications. In Network and Distributed System Security Symposium (NDSS\u201914). San Diego, CA, USA."},{"key":"e_1_3_2_1_21_1","unstructured":"Simon Reinhart. [n.d.]. Auth Analyzer. https:\/\/github.com\/PortSwigger\/auth-analyzer."},{"key":"e_1_3_2_1_22_1","unstructured":"Edward Roberts. [n.d.]. E-commerce-under-attack. https:\/\/www.optiv.com\/insights\/discover\/blog\/black-friday-cybersecurity-covid-ecommerce-under-attack."},{"key":"e_1_3_2_1_23_1","unstructured":"SecurityInnovation.com. [n.d.]. AuthMatrix: Testing authorization in web applications and web services. https:\/\/github.com\/SecurityInnovation\/AuthMatrix."},{"key":"e_1_3_2_1_24_1","volume-title":"2022 Shopify\u2019s biggest year ever. News article (February 16","year":"2022","unstructured":"Shopify.com. [n.d.]. 2022 Shopify\u2019s biggest year ever. News article (February 16, 2022). https:\/\/news.shopify.com\/2021-was-shopifys-biggest-year-ever-2022-lets-go."},{"key":"e_1_3_2_1_25_1","unstructured":"Somdev Sangwan. [n.d.]. Arjun HTTP parameter discovery suite. https:\/\/github.com\/s0md3v\/Arjun."},{"key":"e_1_3_2_1_26_1","unstructured":"Somdev Sangwan. [n.d.]. XSStrike. https:\/\/github.com\/s0md3v\/XSStrike."},{"key":"e_1_3_2_1_27_1","unstructured":"Sqlmap.org. [n.d.]. SQLMap. https:\/\/github.com\/sqlmapproject\/sqlmap."},{"key":"e_1_3_2_1_28_1","volume-title":"NDSS\u201916.","author":"Sudhodanan Avinash","unstructured":"Avinash Sudhodanan, Alessandro Armando, Roberto Carbone, and Luca Compagna. 2016. Attack Patterns for Black-Box Security Testing of Multi-Party Web Applications. In NDSS\u201916. San Diego, CA, USA."},{"key":"e_1_3_2_1_29_1","volume-title":"Detecting Logic Vulnerabilities in E-commerce Applications. In Network and Distributed System Security Symposium (NDSS\u201914)","author":"Sun F.","year":"2014","unstructured":"F. Sun, L.Xu, and Z.Su. 2014. Detecting Logic Vulnerabilities in E-commerce Applications. In Network and Distributed System Security Symposium (NDSS\u201914). San Diego, CA, USA."},{"key":"e_1_3_2_1_30_1","volume-title":"Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service. In USENIX Security Symposium.","author":"Sun Z.","year":"2021","unstructured":"Z. Sun, A. Oest, P. Zhang, Carlos Rubio-Medrano, Tiffany Bao, Ruoyu Wang, Ziming Zhao, Yan Shoshitaishvili, Adam Doup\u00e9, and Gail-Joon Ahn. 2021. Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service. In USENIX Security Symposium."},{"key":"e_1_3_2_1_31_1","unstructured":"Wallarm. [n.d.]. GraphQL batching attacks. https:\/\/lab.wallarm.com\/graphql-batching-attack\/."},{"key":"e_1_3_2_1_32_1","volume-title":"2011 IEEE symposium on security and privacy.","author":"Wang R.","unstructured":"R. Wang, S. Chen, X. Wang, and S. Qadeer. 2011. How to shop for free online\u2013security analysis of cashier-as-a-service based web stores. In 2011 IEEE symposium on security and privacy."},{"key":"e_1_3_2_1_33_1","unstructured":"Wikipedia. [n.d.]. Comparison of shopping cart software. https:\/\/en.wikipedia.org\/wiki\/Comparison_of_shopping_cart_software."},{"key":"e_1_3_2_1_34_1","volume-title":"NDSS\u201913.","author":"Xing Luyi","unstructured":"Luyi Xing, Yangyi Chen, XiaoFeng Wang, and Shuo Chen. 2013. InteGuard: Toward automatic protection of third-party web service integrations. In NDSS\u201913. San Diego, CA, USA."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/2736277.2741650"},{"key":"e_1_3_2_1_36_1","volume-title":"NDSS\u201917.","author":"Yang Wenbo","unstructured":"Wenbo Yang, Yuanyuan Zhang, Juanru Li, Hui Liu, Qing Wang, Yueheng Zhang, and Dawu Gu. 2017. Show Me the Money! Finding Flawed Implementations of Third-party In-app Payment in Android Apps. In NDSS\u201917. San Diego, CA, USA."}],"event":{"name":"WWW '23: The ACM Web Conference 2023","location":"Austin TX USA","acronym":"WWW '23","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2023"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3543507.3583319","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3543507.3583319","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:37:23Z","timestamp":1750178243000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3543507.3583319"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,30]]},"references-count":36,"alternative-id":["10.1145\/3543507.3583319","10.1145\/3543507"],"URL":"https:\/\/doi.org\/10.1145\/3543507.3583319","relation":{},"subject":[],"published":{"date-parts":[[2023,4,30]]},"assertion":[{"value":"2023-04-30","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}