TPC Software

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user.

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform.

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator.

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers.

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data.

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences.

API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering.