The vulnerability is a weak cryptographic implementation in Ecommerce Systempay 1.0 that allows an attacker to brute force the 16‑character production secret key used for payment signature generation. By capturing POST requests to the payment endpoint, an adversary can iteratively test key candidates against SHA1 hash comparisons until the correct key is found, enabling them to forge valid payment signatures and alter transaction amounts. This flaw represents a classic use‑after‑key compromise (CWE‑328) that directly jeopardises the integrity and authenticity of payment transactions.

The affected product is Paiement: Ecommerce Systempay version 1.0. Any deployment of this version is susceptible; no additional sub‑version information is provided.

The CVSS score of 9.3 reflects a high‑risk scenario. Although a specific EPSS score is not available, the exploit requires only remote interaction with the payment endpoint, which is typically exposed over HTTP/S. The vulnerability is not listed in CISA KEV, but the lack of rate limiting or key hardening makes brute‑force attempts feasible. Once the key is recovered, an attacker can autonomously forge transaction signatures and manipulate payment amounts.