Unauthenticated payment forgery via unbound transaction identifiers

Payment forgery in Sifalo Pay before 2.5.3 allows remote attackers to mark pending orders as paid through checkout return verification. The return handler accepts a valid transaction identifier without binding it to the target order or checking order ownership. Exploitation requires one valid identifier from an attacker's own payment and falsifies another pending order's payment status.