Yasin Suer

Missing authentication for a critical function and improper validation of the integrity check value allow for authentication bypass and application API message manipulation via a Man-in-the-Middle attack. This issue occurs during payment callback handling, enabling an attacker positioned between the user and the payment service to alter payment messages and read or modify data without authentication.

Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module contains an improper verification of cryptographic signature issue. This flaw allows for signature spoofing due to improper validation of the cryptographic signatures.

Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module contains an improper verification of cryptographic signature flaw. This allows for signature spoofing due to improper validation of the cryptographic signatures.

Improper neutralization of input during web page generation allows for Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and later executed in the browser of a user visiting the affected page.