Project
Commerce Paybox
Date
Severity
Moderately Critical
Risk Score
13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability
Payment bypass
Affected versions
<7.x-1.6

Description

The Commerce Paybox module integrates with Verifone e-commerce for accepting online payments.

The module has a vulnerability that could be exploited to mark a payment as done and flag an order as completed, without the user actually entering a credit card number.

There is no known mitigation for this vulnerability.

Solution

Install the latest version.

If you use the Commerce Paybox module for Drupal 7, upgrade to Commerce Paybox 7.x-1.6:

Reported by

Fixed by

Coordinated by