| शीर्षक | QubePlug Bangladesh PipraPay 3.0.0 Hard-coded Credentials |
|---|
| विवरण | PipraPay 3.0.0 contains a hard-coded HMAC-SHA256 secret used to verify the alternate pp-token anti-CSRF path. When a request carries a non-empty pp-token, the standard CSRF token check is skipped and the signature is verified against the hard-coded key, which is present in the public source.
An attacker can compute a valid pp-token offline and, by luring an authenticated victim into submitting a crafted cross-site request, bypass CSRF protection for arbitrary state-changing actions.
Reproduction: https://github.com/sumo166/CVE-apply/blob/main/PipraPay/PipraPay/Hardcoded%20HMAC%20Key%20CSRF%20Bypass%20(CWE-798)_cve.md |
|---|
| स्रोत | ⚠️ https://github.com/PipraPay/PipraPay/issues/69 |
|---|
| उपयोगकर्ता | summmm (UID 69690) |
|---|
| सबमिशन | 17/10/2026 03:29 PM (23 दिन पहले) |
|---|
| संयम | 09/11/2026 08:00 AM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 433049 [PipraPay 3.0.0 pp-token anti-CSRF pp-adapter.php hash_hmac कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|