Paymenter, an open‑source webshop solution suffers an unchecked flaw in its PayPal webhook endpoint at /extensions/paypal/webhook. In versions before 1.5.0, the PAYPAL‑CERT‑URL HTTP header is accepted without any validation, allowlisting, or signature checks and is handed directly to PHP’s file_get_contents. This credential‑free behavior lets an unauthenticated attacker direct the server‑side HTTP GET request to any URL, including internal network addresses, resulting in blind server‑side request forgery (CWE‑918). Because no response data is returned, the attack remains covert, but it enables silent probing of internal services or potential data exfiltration through side‑channel techniques. The vulnerability can be leveraged by remote attackers to force the Paymenter server to contact arbitrary external or internal endpoints.

Paymenter, the open-source webshop platform, is affected in all releases prior to version 1.5.0. The PayPal webhook module at /extensions/paypal/webhook processes the PAYPAL‑CERT‑URL header without validation, no allowlist, or signature verification, making the entire application vulnerable. No other vendor or product versions are listed as affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an unauthenticated HTTP request to a publicly exposed endpoint. Depending on the network topology, an attacker could force the Paymenter server to contact internal services or external hosts, using the blind SSRF to probe or exfiltrate data through side‑channel methods. Because no response data is returned, the attack remains covert, but it remains useful for reconnaissance or stealthy data exfiltration.