CVE-2012-5806

CVE-2012-5806 describes a critical vulnerability in the PayPal Payments Pro module for Zen Cart, where the module fails to properly validate SSL server hostnames against X.509 certificate fields. This oversight, stemming from the use of the PHP fsockopen function, enables man-in-the-middle attackers to spoof legitimate SSL servers using any valid certificate. Rated with a CVSS score of 5.8, this vulnerability has a network attack vector and medium attack complexity, potentially leading to partial compromise of confidentiality and integrity. While the EPSS score is low, indicating a lower likelihood of exploitation, the FAUCET Risk Score of 28/100 suggests a moderate risk. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Furthermore, the vulnerability has garnered minimal community discussion or media coverage, suggesting it is not widely known or actively targeted.