Paytr Virtual Pos Iframe Api V9X Whmcs Module
Monthly
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote unauthenticated attackers spoof a trusted payment identifier so the module treats an unpaid or attacker-controlled transaction as legitimately settled. Reported by TR-CERT, it stems from the module relying on a less-trusted, client-influenceable source instead of server-to-server verification of PayTR's callback. No public exploit is identified at time of analysis, and no EPSS or KEV data was supplied.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remote attackers to perform black-box reverse engineering of internal secret values - such as HMAC keys or API signing tokens - by measuring statistically distinguishable response-time differences across repeated crafted requests. The CWE-208 root cause is a non-constant-time comparison operation in the module's payment verification logic, which leaks information about secret material byte-by-byte through observable latency variations. No public exploit code or CISA KEV listing has been identified, but the network-exposed nature of the payment endpoint makes the attack surface broadly reachable for any operator of the affected module.
Input data manipulation in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module versions 9.0.0 through 9.0.2 allows unauthenticated remote attackers to submit improperly validated quantity values during the payment flow, per CVSS PR:N/AV:N/UI:N. CWE-1284 (Improper Validation of Specified Quantity in Input) in a payment gateway context typically enables transaction amount tampering - yet the vendor-assigned CVSS vector scores I:N/A:H, characterizing the impact as primarily availability disruption rather than integrity compromise, a direct contradiction with the 'Input Data Manipulation' label applied to the finding. Reported by TR-CERT; no public exploit or KEV listing identified at time of analysis.
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote unauthenticated attackers spoof a trusted payment identifier so the module treats an unpaid or attacker-controlled transaction as legitimately settled. Reported by TR-CERT, it stems from the module relying on a less-trusted, client-influenceable source instead of server-to-server verification of PayTR's callback. No public exploit is identified at time of analysis, and no EPSS or KEV data was supplied.
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remote attackers to perform black-box reverse engineering of internal secret values - such as HMAC keys or API signing tokens - by measuring statistically distinguishable response-time differences across repeated crafted requests. The CWE-208 root cause is a non-constant-time comparison operation in the module's payment verification logic, which leaks information about secret material byte-by-byte through observable latency variations. No public exploit code or CISA KEV listing has been identified, but the network-exposed nature of the payment endpoint makes the attack surface broadly reachable for any operator of the affected module.
Input data manipulation in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module versions 9.0.0 through 9.0.2 allows unauthenticated remote attackers to submit improperly validated quantity values during the payment flow, per CVSS PR:N/AV:N/UI:N. CWE-1284 (Improper Validation of Specified Quantity in Input) in a payment gateway context typically enables transaction amount tampering - yet the vendor-assigned CVSS vector scores I:N/A:H, characterizing the impact as primarily availability disruption rather than integrity compromise, a direct contradiction with the 'Input Data Manipulation' label applied to the finding. Reported by TR-CERT; no public exploit or KEV listing identified at time of analysis.