Secunia says the security issue is caused by the CURL application being set to false when communicating with a payment gateway over SSL, causing the CURL library to not properly verify the peer certificate. This can be exploited in a man-in-the-middle attack to decrypt all communications between ModernBill and the payment gateway.

Secunia says the security flaw appears in versions 5.0.1 and 5.0.4. Other versions may also be affected. It is rated less critical by the company.

According to the vulnerability intelligence provider the best solution for now is to avoid configuring the application to use the payment gateway or to use another product until the vulnerabilities have been addressed.