ZongXR SuperMarket vulnerabilities

A weakness has been identified in ZongXR SuperMarket 1.0.0.0 affecting the startBuy function of the Instant Buy component. Manipulating the Username argument leads to missing authentication. The attack can be performed remotely. The exploit has been publicly disclosed and may be used for attacks. The project was informed but has not responded.

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0 affecting the OrderController.deleteOrder function of the Order Deletion Endpoint. Manipulating the orderId argument results in missing authentication. The attack can be carried out remotely. The exploit has been publicly released and may be used. The project was informed but has not responded.

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected is the function OrderController.addOrder in order/src/main/java/com/supermarket/order/controller/OrderController.java of the save Endpoint component. Manipulation of the userId argument leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used; the project was informed but has not responded.