BankPro E-Service Technology's Service Center contains a CWE-639 vulnerability, specifically an authorization bypass via user-controlled key manipulation. Authenticated attackers can modify a parameter in a query function to access EC order details belonging to other users, indicating insufficient access control checks. The vulnerability is network exploitable with low attack complexity and no user interaction required. The CVSS 4.0 vector indicates high impact on confidentiality but no impact on integrity or availability.

Successful exploitation allows an authenticated attacker to access sensitive EC order details of other users, potentially leading to unauthorized disclosure of confidential information. There is no indication of impact on system integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is documented, organizations should monitor for vendor updates and consider restricting access to the affected query function to trusted users only until a patch is available.