Executive brief
Paymenter, an open-source platform for managing hosting services and webshops, contains a security flaw in its PayPal payment integration. An attacker can trick the server into making unauthorized web requests to internal or external systems. This could allow an attacker to probe your private internal network or interact with other internal services that are not normally exposed to the internet.
Technical details
A blind Server-Side Request Forgery (SSRF) vulnerability exists in the PayPal gateway module of Paymenter. The application processes the 'PAYPAL-CERT-URL' HTTP header at the '/extensions/paypal/webhook' endpoint and passes it directly to the PHP 'file_get_contents' function without validation or allowlisting. A remote, unauthenticated attacker can exploit this to induce the server to perform HTTP GET requests to arbitrary internal or external IP addresses. While the attacker does not receive the direct response body, they can use this to probe internal network services or facilitate data exfiltration via side channels. The issue is resolved in version 1.5.0.
Affected products
- Paymenter Paymenter < 1.5.0
Timeline
- 2026-06-10: advisory: Original GitHub security advisory published
- 2026-07-20: disclosed: NVD publication date
- 2026-07-20: patched: Fix released in version 1.5.0