Vulnerability · Published May 13, 2026 · Assigned by VulnCheck
CVE-2020-37168Ecommerce Systempay 1.0 Production Key Brute Force
Critical 9.8
In plain English
A critical-severity security flaw in Ecommerce Systempay from Paiement. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key, enabling them to forge valid payment signatures and manipulate transaction amounts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Paiement | Ecommerce Systempay | 1.0 |
Weakness: CWE-328 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-48017 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Ecommerce Systempay 1.0 Production Key Brute Force third-party-advisory