provided by Star2Billing S.L.

if following check is true

$this->agiconfig['cid_enable'] == 1 && $this->agiconfig['cid_auto_assign_card_to_cid'

and used expired or blocked pin, then you got current cid added to that expired or blocked card.

Reason: check for strlen(prompt)>0 AFTER section which add cid.


As result you got easy exploit if cid_auto_assign_Card_to_cid is enabled.