Authentication Bypass in ZongXR Supermarket 1.0.0.0

Executive Summary

This vulnerability is a missing authentication flaw in ZongXR Supermarket 1.0.0.0. The POST /order/manage/save endpoint allows unauthenticated attackers to inject arbitrary orders under any user's identity by supplying a victim's userId in the request. The endpoint accepts userId directly from the client without session or ticket validation, enabling 'ghost order' pollution in victims' order histories.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthenticated POST requests to /order/manage/save endpoint with arbitrary userId parameters. Monitor for orders created without valid session tokens or authentication headers. Inspect gateway logs for external access to /order/** paths.

Useful 0 Not Useful 0

Impact Analysis

An attacker could inject fake orders under your name, polluting your order history and potentially disrupting auditing, accounting, and fulfillment workflows. The backend's money validation logic also uses the attacker-controlled userId, further compromising business logic and financial processes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to /order/manage/save endpoint by adding it to authentication check lists in the gateway configuration. Validate userId ownership server-side before processing orders. Implement session or token validation for all order-related requests.

Useful 0 Not Useful 0