This vulnerability affects the OrderController.addOrder function in ZongXR Supermarket 1.0.0.0, specifically in the save endpoint implementation. Manipulation of the userId argument leads to missing authentication, allowing remote attackers to potentially submit orders without proper authorization. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Although the project was informed early, no response or patch has been provided. Public exploit code exists, but there is no evidence of active exploitation in the wild.

The vulnerability allows remote attackers to bypass authentication controls in the order submission process by manipulating the userId parameter. This could lead to unauthorized order creation or manipulation within the affected system. There is no indication of privilege escalation or data disclosure beyond the order functionality. The medium severity score reflects the potential impact on business operations and trust.

No official fix or patch is currently available for this vulnerability. Since the vendor has not responded or released a remediation, users should consider implementing additional access controls or input validation around the affected endpoint as a temporary measure. Monitor vendor advisories for updates and apply patches promptly once available.