Threats tagged 'ghsa-qfwr-rmpq-mvmx'

mews/pos versions up to 2.0.0 have a vulnerability due to insufficient verification of data authenticity. This flaw allows unauthenticated attackers to forge payment results by submitting unverified callbacks. Specifically, the GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host handlers do not perform the check3DHash() verification, enabling attackers to tamper with status, amount, or order ID fields and complete orders without payment.