Authentication Bypass in ZongXR SuperMarket via Username Manipulation

Executive Summary

This vulnerability is an access control weakness in ZongXR SuperMarket 1.0.0.0. It allows an authenticated attacker to manipulate the username parameter in the instant buy feature to create fake purchase records for other users. The system does not validate if the username in the request matches the authenticated user, enabling attackers to deplete inventory or block legitimate purchases for victims.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the endpoint GET /instantbuy/manage/{itemId}/{userName} where the userName parameter does not match the authenticated user's identity. Check for unusual Redis key patterns or database records created under arbitrary usernames. Review logs for repeated 'Already purchased' errors from legitimate users.

Useful 0 Not Useful 0

Impact Analysis

If you use ZongXR SuperMarket, an attacker could manipulate your username to burn your one-time purchase eligibility, block your ability to buy items, or deplete inventory under your name. This could prevent you from purchasing desired items or cause financial losses if inventory is wasted.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict the GET /instantbuy/manage/{itemId}/{userName} endpoint to use only the authenticated user's username. Validate that the path parameter matches the authenticated user's identity before processing requests. Implement checks for duplicate purchases before inventory updates to prevent race conditions.

Useful 0 Not Useful 0