Description
Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify the parameter of a specific query function to access other users' EC order details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BankPro E-Service Technology | Service Center | — | — |
References
- https://www.twcert.org.tw/tw/cp-132-10938-97ddd-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-10940-d90bd-2.html third-party-advisory