Paymorrow Improper Input Validation Vulnerability in oxid-esales/paymorrow-module
Summary
CVE-2018-14020: Paymorrow Improper Input Validation vulnerability. Affects oxid-esales/paymorrow-module across 2 version ranges.
>= 1.0.0, < 1.0.2
>= 2.0.0, < 2.0.1
Fixed in 1.0.2 or 2.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The oxid-esales/paymorrow-module is a payment module for OXID eShop. It allows merchants to integrate the Paymorrow payment service into their e-commerce platform. The module provides functionality for processing payments and managing delivery addresses. However, a vulnerability has been discovered in versions 1.0.0 to 1.0.2 and 2.0.0 to 2.0.1 of the module, which can be exploited to bypass delivery-address change detection if the payment module is not properly integrated with the eShop's checkout procedure.
Vulnerability Detail
The vulnerability arises from improper input validation in the Paymorrow module. An attacker can change the delivery address to an unverified address, bypassing the Paymorrow module's verification process. This can potentially lead to fraudulent transactions or unauthorized access to sensitive customer information. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.21.0.2composer require oxid-esales/paymorrow-module:1.0.2 -
>= 2.0.0, < 2.0.12.0.1composer require oxid-esales/paymorrow-module:2.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If an immediate update is not feasible, a temporary workaround is to manually validate and verify delivery addresses before processing payments. This can be done by implementing custom validation logic within the eShop's checkout procedure, ensuring that only verified addresses are accepted by the Paymorrow module.
Conclusion
The Paymorrow module in oxid-esales/paymorrow-module is vulnerable to an improper input validation issue that allows attackers to bypass delivery-address change detection. To mitigate the risk, it is recommended to update the module to the fixed versions or implement a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oxid-esales/paymorrow-module →
FAQ
The vulnerability allows attackers to bypass delivery-address change detection, potentially leading to fraudulent transactions or unauthorized access to customer information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze and alert you if the vulnerability is present.
No, only versions 1.0.0 to 1.0.2 and 2.0.0 to 2.0.1 of the oxid-esales/paymorrow-module are affected by this vulnerability. It is recommended to update to the fixed versions to mitigate the risk.
Yes, a temporary workaround is to manually validate and verify delivery addresses before processing payments. This can be done by implementing custom validation logic within the eShop's checkout procedure.
You can find more information about the vulnerability, including its technical details and the fixed versions, in the advisory on GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json
