Opencart Virtual Pos Module
Monthly
Signature spoofing in the Sipay Electronic Money and Payment Services OpenCart Virtual POS Module (versions 26.8.2 up to but not including 26.9.1) lets unauthenticated remote attackers bypass cryptographic signature verification and submit forged or tampered payment tokens, most plausibly spoofed JWTs in the payment callback/token-verification flow, which can expose payment data and permit unauthorized manipulation of transaction processing. The flaw is network-reachable with no authentication or user interaction required (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, CWE-347), and an independent assessment narrows the impact to high confidentiality and integrity loss without an availability component, giving a 9.1-equivalent severity rather than the originally cited 9.8. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, but exploitation requires only that a store runs the vulnerable module version with its callback endpoint reachable. Reported by TR-CERT; a vendor fix is available in 26.9.1.
Signature spoofing in the Sipay Electronic Money and Payment Services OpenCart Virtual POS Module (versions 26.8.2 up to but not including 26.9.1) lets unauthenticated remote attackers bypass cryptographic signature verification and submit forged or tampered payment tokens, most plausibly spoofed JWTs in the payment callback/token-verification flow, which can expose payment data and permit unauthorized manipulation of transaction processing. The flaw is network-reachable with no authentication or user interaction required (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, CWE-347), and an independent assessment narrows the impact to high confidentiality and integrity loss without an availability component, giving a 9.1-equivalent severity rather than the originally cited 9.8. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, but exploitation requires only that a store runs the vulnerable module version with its callback endpoint reachable. Reported by TR-CERT; a vendor fix is available in 26.9.1.