BankPro E-Service Technology Service Center Insecure Direct Object Reference Vulnerability

A vulnerability allowing authenticated remote attackers to access other users' EC order details has been identified in the Service Center application developed by BankPro E-Service Technology. This Insecure Direct Object Reference vulnerability arises from the ability to modify parameters in specific query functions, thereby gaining unauthorized access to sensitive order information.

Impact

Exploitation of this vulnerability allows for unauthorized access to other users' EC order details.

Remediation

The vulnerability has been patched server-side, and users do not need to take any action.