Paiement Ecommerce Systempay 1.0 Payment Endpoint weak hash

Summaryinfo

A vulnerability classified as critical was found in Paiement Ecommerce Systempay 1.0. This affects an unknown part of the component Payment Endpoint. The manipulation results in weak hash. This vulnerability is reported as CVE-2020-37168. The attack can be launched remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Paiement Ecommerce Systempay 1.0. It has been classified as critical. Affected is an unknown function of the component Payment Endpoint. The manipulation with an unknown input leads to a weak hash vulnerability. CWE is classifying the issue as CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key, enabling them to forge valid payment signatures and manipulate transaction amounts.

The weakness was disclosed by live3 as 48017. The advisory is shared for download at exploit-db.com. This vulnerability is traded as CVE-2020-37168 since 02/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1600.001.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• E-Commerce Management Software

Vendor

• Paiement

Name

• Ecommerce Systempay

Version

• 1.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion