Executive brief
Ecommerce Systempay, a payment processing module, contains a security flaw in how it handles payment signatures. An attacker can intercept payment data and use automated tools to guess the secret production key used to verify transactions. Once discovered, this key allows an attacker to forge successful payment confirmations or change transaction amounts, leading to direct financial loss and fraudulent orders.
Technical details
The vulnerability stems from a weak cryptographic implementation (CWE-328) in Ecommerce Systempay 1.0. The system uses a 16-character production secret key and SHA1 hashing to generate payment signatures for POST requests sent to the payment endpoint. Because the signature generation process is predictable and relies on a weak hash, an attacker can capture legitimate payment form data and signatures, then perform an offline brute-force attack against the secret key. Once the key is recovered, the attacker can generate valid signatures for arbitrary data, allowing them to bypass payment verification or modify transaction details such as price and currency. A public exploit script exists for this vulnerability.
Affected products
- Ecommerce Systempay 1.0 and earlier
Timeline
- 2020-02-05: disclosed: Initial exploit code published by researcher live3
- 2026-05-13: advisory: NVD and VulnCheck published advisory details