CVE-2020-37168 - Vulnerability Analysis

Overview

Ecommerce Systempay 1.0 contains a weak cryptographic implementation caused by the use of SHA1 for payment signature generation, letting attackers brute force the production secret key to forge valid payment signatures, exploit requires access to payment POST requests.

Severity & Score

Impact

Attackers can forge valid payment signatures and manipulate transaction amounts, leading to financial fraud and unauthorized transactions.

Mitigation

Update to a version that uses strong cryptographic algorithms for payment signature generation or apply patches to replace SHA1 with a secure hash function.

References

• https://paiement.systempay.fr/doc/fr-FR/
• https://paiement.systempay.fr/doc/fr-FR/module-de-paiement-gratuit/
• https://www.exploit-db.com/exploits/48017
• https://www.vulncheck.com/advisories/ecommerce-systempay-production-key-brute-force

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner