CVE-2022-30628

Name of the Vulnerable Software and Affected Versions Supersmart (affected versions not specified)

Description The issue allows downloading all receipts without authentication. To exploit this, an attacker must first access the API endpoint "https://XXXX.supersmart.me/services/v4/customer/signin" to obtain a TOKEN. Then, they can access the API that provides invoice images based on the URL "https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.