based on hotfix 22 what is the current merchant exploit?