CVE-2026-108568: InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity
A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient verification of data authenticity. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
InstantSoft icms2 versions up to and including 2.18.2 are affected when the Billing Module is present, specifically its PayPal handling action in system/controllers/billing/actions/paypal.php.
What access does an attacker need?
The attack can be launched remotely with low attack complexity, but it requires low-level privileges. No user interaction is required.
What is manipulated during exploitation?
The issue involves manipulation of the bid and sig arguments processed by validatePaypalOrder. Insufficient verification of data authenticity can result in an integrity impact.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What should organizations do if they cannot patch immediately?
The provided information does not identify a mitigation or workaround. Prioritize restricting access to the affected billing and PayPal-related functionality and monitor requests involving the bid and sig arguments.