PT-2026-29217 · Unknown · Business::Onlinepayment::Storedtransaction

Published 2026-03-31 · Updated 2026-04-02 · CVE-2025-15618

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Business::OnlinePayment::StoredTransaction versions through 0.01

Description The software generates a secret key using an MD5 hash of a single call to the rand function, which is not suitable for cryptographic purposes. This key is used for encrypting credit card transaction data.

Recommendations Versions prior to 0.01 should be updated.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

CWE-338

Related Identifiers

CVE-2025-15618

Affected Products

Business::Onlinepayment::Storedtransaction

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-15618 · Security Note
• https://security.metacpan.org/patches/B/Business-OnlinePayment-StoredTransaction/0.01/CVE-2025-15618-r1.patch · Patch
• https://twitter.com/TheHackerWire/status/2039024977136288145 · Twitter Post
• https://twitter.com/CosmicBytez/status/2039270378393239754 · Twitter Post
• https://twitter.com/CVEnew/status/2039004497343623300 · Twitter Post
• https://twitter.com/oss_security/status/2039551111267287255 · Twitter Post
• https://metacpan.org/dist/Business-OnlinePayment-StoredTransaction/source/lib/Business/OnlinePayment/StoredTransaction.pm#L64-75 · Note
• http://openwall.com/lists/oss-security/2026/03/31/7 · Note