PT-2026-116006 · Jeequan · Jeepay
CVSS v3.1
7.1
عالية
| المتجه | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT MCH PAY CONFIG ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
إصلاح
IDOR
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Jeepay