Sannomiya

**Name of the Vulnerable Software and Affected Versions** WonderTrader versions prior to 1.0.0 **Description** A remote attack is possible through the manipulation of the `FID JYLB` argument within the `TraderDD::queryTrades()` function located in the src/TraderDD/TraderDD.cpp file. This action results in the enforcement of a behavioral workflow. The attack is characterized by high complexity and is considered difficult to exploit. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `TraderDD::queryTrades()` function.

**Name of the Vulnerable Software and Affected Versions** WonderTrader versions prior to 0.9.9 **Description** A remote issue exists in the TraderATP Cash Trade Conversion component within the file src/Includes/WTSTradeDef.hpp. Manipulating the `m offsetType` argument can lead to the use of an uninitialized variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WonderTrader versions prior to 1.0.0 **Description** A remote issue exists in the Pending Order Handler component within the `src/WtCore/TraderAdapter.h` library. Manipulation of the `getUndoneQty` argument in the ` undone qty()` function allows an attacker to enforce a behavioral workflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the ` undone qty()` function within the Pending Order Handler component.

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.