The function refundETH in Payment.sol is used by users to get their ether back if they send more than the needed amount when using the function pay. The problem here is as how the function is designed, any eth values in the contract can be withdrawn by anyone. This bring the risk, where a malicious users can front-run users and successfuly steal their refunds.
