Business::OnlinePayment::StoredTransaction creates a secret key by hashing a single value from Perl’s built‑in rand function with MD5. This practice produces a deterministic, low‑entropy key that is unsuitable for protecting sensitive data. Attackers who can obtain the key can decrypt stored credit card information, compromising customer and potentially enabling financial fraud and regulatory violations.

The issue affects the Perl module Business::OnlinePayment::StoredTransaction version 0.01. The module is distributed by the vendor MOCK under the identifier Business::OnlinePayment::StoredTransaction and is used for encrypting transaction histories in online payment systems.

The CVSS score of 9.1 reflects a severe risk to data confidentiality. The EPSS score is below 1%, indicating low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to interact with the application—either by supplying crafted input or by executing code within the process—to retrieve or calculate the weak key, then use that key to decrypt saved card data. The attack vector is inferred to be application‑level, requiring user interaction or code execution within the affected environment.