Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key, enabling them to forge valid payment signatures and manipulate transaction amounts.
The attacker intercepts payment form data and signatures sent via POST method to the payment endpoint. Then, using the SHA1 algorithm to compare hashes, they iteratively test successive key candidates until finding the correct 16-character production key. The short key length combined with the weak SHA1 algorithm (CWE-328) makes brute force attack realistically feasible. After obtaining the key, the attacker can generate their own fully valid payment signatures.
An attacker can forge payment signatures and manipulate transaction amounts, leading to financial fraud and enabling payments with arbitrarily modified values without detection by the verification system.
Apply patches available from the vendor according to the references provided. Additionally, it is recommended to immediately rotate the production key, increase its length, and migrate to a stronger cryptographic algorithm instead of SHA1.
Ecommerce Systempay version 1.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X