This vulnerability in ZongXR SuperMarket 1.0.0.0 involves missing authentication in the OrderController.deleteOrder endpoint. By manipulating the orderId argument, an attacker can bypass authentication controls remotely and delete orders. The flaw is present in the order/src/main/java/com/supermarket/order/controller/OrderController.java component. The vulnerability is publicly known with an exploit available, but no official fix or patch has been released by the vendor as of the publication date.

An attacker can remotely delete orders without authentication, potentially disrupting order management and causing unauthorized data modification or loss. The vulnerability's CVSS score of 6.9 indicates a medium severity impact with low attack complexity and no required privileges or user interaction.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is provided, restricting access to the affected endpoint via network controls or implementing additional authentication checks at the application or infrastructure level may help mitigate risk.