Roncoo Pay
Monthly
Unauthenticated remote attackers can retrieve full payment records from Roncoo-pay by exploiting a missing authorization check in the F2FPayController.orderQuery endpoint. The vulnerability (CWE-306) allows access to any merchant's transaction data if the attacker can guess or enumerate a valid transaction number, which follows a predictable format ('7' prefix plus a snowflake ID). No public exploit code is known at this time, and exploitation requires network access to the web gateway and successful guessing of a transaction number, making it a complexity-limited information-disclosure issue.
Unauthenticated remote attackers can retrieve full payment records from Roncoo-pay by exploiting a missing authorization check in the F2FPayController.orderQuery endpoint. The vulnerability (CWE-306) allows access to any merchant's transaction data if the attacker can guess or enumerate a valid transaction number, which follows a predictable format ('7' prefix plus a snowflake ID). No public exploit code is known at this time, and exploitation requires network access to the web gateway and successful guessing of a transaction number, making it a complexity-limited information-disclosure issue.