A vulnerability was discovered in the startBuy function of the Instant Buy component of ZongXR SuperMarket. By manipulating the Username parameter, a caller can bypass the authentication check that normally protects the purchase initiation process, allowing an attacker to trigger a transaction without valid credentials. This flaw directly violates authentication controls and, without additional safeguards, can lead to unauthorized financial actions or data exposure. The flaw can be exploited from a remote position, as the service accepts the Username argument over network calls, and the attacker may supply arbitrary values to trigger the purchase flow.

ZongXR’s SuperMarket application version 1.0.0.0, specifically the Instant Buy module located at instant‑buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java, is affected. The problem exists only in the 1.0.0.0 release; later or older versions were not reported as vulnerable. The impact applies to any deployment that exposes the startBuy endpoint to external parties.

The CVSS base score of 5.3 indicates moderate overall severity. No EPSS score is available, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting that large‑scale exploitation is not currently documented. Nonetheless, the public availability of an exploit and the ability to conduct the attack remotely raise the likelihood of abuse, especially against exposed interfaces. The attack requires only an unauthenticated request containing a crafted Username field; the attacker does not need elevated privileges or prior access. Due to the absence of a strong authentication mechanism, the potential damage could include unauthorized purchases, financial loss, or serving as a foothold for further compromise.