Vulnerability in mewebstudio pos

[ Description ]Official description

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/mewebstudio/pos
• github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/In…
• github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/Pa…
• github.com/mewebstudio/pos/commit/7c59d42bc49483c7c54999d757cb67055d9f732a
• github.com/mewebstudio/pos/issues/306
• github.com/mewebstudio/pos/pull/305
• www.vulncheck.com/advisories/mews-pos-through-2.0.0-missing-hash-verification-in-3d-pay…