Israel National Cyber Directorate AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Israel National Cyber Directorate AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

A-No availability impacts identified

AV-Lack of information

C-No confidentiality impacts identified

I-No limiting factors

PR-No privileges needed

UI-User Interaction not identified

Israel National Cyber Directorate CWE-79

Israel National Cyber Directorate CWE-284

CWE-284 / Not enough information

Supersmart.me - Walk Through Performing unauthorized actions on other customers. Supersmart.me has a product designed to conduct smart shopping in stores. The customer receives a coder (or using an Android application) to scan at the beginning of the purchase the QR CODE on the cart, and then all the products he wants to purchase. At the end of the purchase the customer can pay independently. During the research it was discovered that it is possible to reset another customer's cart without verification. Because the number of purchases is serial.

insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code.

https://www.gov.il/en/departments/faq/cve_advisories [No Types Assigned]

https://www.gov.il/en/Departments/faq/cve_advisories [Third Party Advisory]