[ooo082]

We have discovered a vulnerability in a Thai-based order aggregation management system that allows enumeration of store IDs to obtain all user account passwords. We subsequently used the obtained passwords and tokens to take over user access. We have attempted to enumerate the passwords of 20,000 enterprise user accounts and tried to obtain some data using user-registered accounts (the website does not require two-factor authentication). Below is an example of order data owned by a user. We are selling the website's data and the exploitation methods. Currently, no vulnerabilities have been found on the website, nor have any patches been implemented. We are also selling all user account passwords. Due to the extremely low difficulty of exploiting this vulnerability, we will not disclose the website URL until the transaction is completed.


TG;@bbl082