CVE-2026-110607 Details
Description
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
A payment verification bypass vulnerability has been identified in BizSpring Shop, specifically in the PaymentController. This vulnerability allows authenticated buyers to mark orders as paid without actually completing the payment. By calling the 'testPostPay' handler with a payment log serial number, attackers can obtain goods without payment. Additionally, this vulnerability can be exploited to settle orders of other members by using their payment log serial numbers.
Remove the 'test_post_pay' endpoint from the PaymentController or restrict it to a non-production profile. Implement a proper payment verification process that includes gateway callbacks, signature checks, and ownership validations before completing any payment.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BizSpring Shop | <= cf22d39daaf1 |
CPE
Remediation
| |
| BizSpring Java Mall | <= 369e88c5cda3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |