PT-2026-28169 · Unknown · Wechat Pay
Yansongda
·
Publicado
2026-03-25
·
Atualizado
2026-03-26
·
CVE-2026-33661
CVSS v3.1
8.6
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Pay versions prior to 3.7.20
Description
The
verify wechat sign() function in src/Functions.php does not properly validate signatures when the Host header in a PSR-7 request is set to localhost. This allows an attacker to bypass the RSA signature check by sending a crafted HTTP request to the WeChat Pay callback endpoint with a Host: localhost header. This can lead to the forging of fake WeChat Pay payment success notifications, potentially resulting in applications incorrectly marking orders as paid without actual payment. The vulnerable code is located in src/Functions.php lines 243-246. The function verify wechat sign() is vulnerable. The API endpoint affected is the WeChat Pay callback endpoint. The Host header is a vulnerable parameter.Recommendations
Versions prior to 3.7.20 should be updated to version 3.7.20 or later.
Exploit
Correção
Authentication Bypass by Spoofing
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wechat Pay