Payment verification bypass in BizSpring Shop lets buyers skip payment
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.
Summary
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass that lets authenticated buyers mark their orders as paid. An authenticated remote attacker with low privileges can call the PaymentController.testPostPay handler to obtain goods without paying or to settle other members' orders. The flaw is classified as CWE-345, insufficient verification of data authenticity.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for BizSpring Shop.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-14 Threatist record created from CVE-2026-110607
- 2026-10-14 Alias added: GHSA-r6p5-w7hv-x5rq
- 2026-10-15 CISA SSVC decision points changed
References
Advisory 2
Other 5
- https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/PaymentController.java#L76-L84
- https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/service/impl/PaymentLogServiceImpl.java#L143-L169
- https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/PaymentController.java#L76-L84
- https://github.com/BizSpringSource/bizspring-shop-opensource
- https://github.com/bizspring-open/BizSpring-Java-Mall
More BizSpring vulnerabilities
- TI-2026-74102 Insecure direct object reference in BizSpring Shop order handling CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-110607 · CVE Program
- CVE-2026-110607 · NVD
- FIRST EPSS
- GHSA-r6p5-w7hv-x5rq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences