This vulnerability affects ZongXR SuperMarket 1.0.0.0 specifically in the startBuy function within the InstantBuyController.java file of the Instant Buy component. An attacker can remotely manipulate the Username argument, leading to missing authentication controls. The issue was reported to the project early, but no fix or official response has been provided. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no user interaction, and limited privileges required.

Successful exploitation allows an attacker to bypass authentication mechanisms remotely by manipulating the Username argument in the startBuy function. This could lead to unauthorized actions within the affected component. The exploit is publicly available, increasing the risk of attack, though no active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider restricting access to the affected functionality or implementing additional authentication checks at the application or network level to mitigate unauthorized use.