Vulnerability in Paiement Ecommerce Systempay
CVE-2020-37168
Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key, enabling them to forge valid payment signatures and manipulate transaction amounts.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (14.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 14th percentile — 14.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Paiement Ecommerce Systempay — versions 1.0
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/48017 (exploit)
- paiement.systempay.fr/doc/fr-FR/ (product)
- paiement.systempay.fr/doc/fr-FR/module-de-paiement-gratuit/ (product)
- www.vulncheck.com/advisories/ecommerce-systempay-production-key-brute-force (third-party-advisory)
Frequently asked questions
- What is CVE-2020-37168?
- CVE-2020-37168 is a critical-severity vulnerability in Paiement Ecommerce Systempay, classified under Use of Weak Hash. CVSS score: 9.8/10. Published 2026-05-13.
- How severe is CVE-2020-37168?
- Critical severity. CVSS v3 base score is 9.8 out of 10.