Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for BizSpring Java Mall by BizSpring

    CVE-2026-110608 (GCVE-0-2026-110608)

    Vulnerability from nvd – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16
    VLAI
    Title
    BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
    Summary
    BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6106 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    BizSpring BizSpring Shop Affected: 0 , ≤ cf22d39daaf17f430d8fc1fb698a2f6e515e1808 (git)
    		Create a notification for this product.
    BizSpring BizSpring Java Mall Affected: 0 , ≤ 369e88c5cda36ddcea56742c335ee1bfe50e8156 (git)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/BizSpringSource/bizspring-shop-opensource",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/BizSpringSource/bizspring-shop-opensource",
          "product": "BizSpring Shop",
          "repo": "https://github.com/BizSpringSource/bizspring-shop-opensource",
          "vendor": "BizSpring",
          "versions": [
            {
              "lessThanOrEqual": "cf22d39daaf17f430d8fc1fb698a2f6e515e1808",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/bizspring-open/BizSpring-Java-Mall",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/bizspring-open/BizSpring-Java-Mall",
          "product": "BizSpring Java Mall",
          "repo": "https://github.com/bizspring-open/BizSpring-Java-Mall",
          "vendor": "BizSpring",
          "versions": [
            {
              "lessThanOrEqual": "369e88c5cda36ddcea56742c335ee1bfe50e8156",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members\u0027 orders by supplying their orderId. Attackers can cancel victims\u0027 pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim\u0027s consent."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:49.839Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/bizspring-open/BizSpring-Java-Mall"
        },
        {
          "name": "VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-idor-via-member-order-cancel-and-receive"
        }
      ],
      "title": "BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110608",
    "datePublished": "2026-10-14T14:16:49.839Z",
    "dateReserved": "2026-10-14T13:07:22.907Z",
    "dateUpdated": "2026-10-14T14:16:49.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110607 (GCVE-0-2026-110607)

    Vulnerability from nvd – Published: 2026-10-14 14:16 – Updated: 2026-10-14 18:02
    VLAI
    Title
    BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
    Summary
    BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
    Severity
    7.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-14 18:02 UTC
    CWE
    • CWE-345 - Insufficient Verification of Data Authenticity
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6106 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    BizSpring BizSpring Shop Affected: 0 , ≤ cf22d39daaf17f430d8fc1fb698a2f6e515e1808 (git)
    		Create a notification for this product.
    BizSpring BizSpring Java Mall Affected: 0 , ≤ 369e88c5cda36ddcea56742c335ee1bfe50e8156 (git)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110607",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:02:11.286413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:02:45.647Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-shop-test-pay-endpoint-order-settlement-bypass"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/BizSpringSource/bizspring-shop-opensource",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/BizSpringSource/bizspring-shop-opensource",
          "product": "BizSpring Shop",
          "repo": "https://github.com/BizSpringSource/bizspring-shop-opensource",
          "vendor": "BizSpring",
          "versions": [
            {
              "lessThanOrEqual": "cf22d39daaf17f430d8fc1fb698a2f6e515e1808",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/bizspring-open/BizSpring-Java-Mall",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/bizspring-open/BizSpring-Java-Mall",
          "product": "BizSpring Java Mall",
          "repo": "https://github.com/bizspring-open/BizSpring-Java-Mall",
          "vendor": "BizSpring",
          "versions": [
            {
              "lessThanOrEqual": "369e88c5cda36ddcea56742c335ee1bfe50e8156",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members\u0027 orders."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:47.014Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-shop-test-pay-endpoint-order-settlement-bypass"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/PaymentController.java#L76-L84"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/service/impl/PaymentLogServiceImpl.java#L143-L169"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/PaymentController.java#L76-L84"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/bizspring-open/BizSpring-Java-Mall"
        },
        {
          "name": "VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-payment-bypass-via-test-post-pay-endpoint"
        }
      ],
      "title": "BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110607",
    "datePublished": "2026-10-14T14:16:47.014Z",
    "dateReserved": "2026-10-14T13:07:22.562Z",
    "dateUpdated": "2026-10-14T18:02:45.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110608 (GCVE-0-2026-110608)

    Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16
    VLAI
    Title
    BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
    Summary
    BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6106 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    BizSpring BizSpring Shop Affected: 0 , ≤ cf22d39daaf17f430d8fc1fb698a2f6e515e1808 (git)
    		Create a notification for this product.
    BizSpring BizSpring Java Mall Affected: 0 , ≤ 369e88c5cda36ddcea56742c335ee1bfe50e8156 (git)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/BizSpringSource/bizspring-shop-opensource",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/BizSpringSource/bizspring-shop-opensource",
          "product": "BizSpring Shop",
          "repo": "https://github.com/BizSpringSource/bizspring-shop-opensource",
          "vendor": "BizSpring",
          "versions": [
            {
              "lessThanOrEqual": "cf22d39daaf17f430d8fc1fb698a2f6e515e1808",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/bizspring-open/BizSpring-Java-Mall",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/bizspring-open/BizSpring-Java-Mall",
          "product": "BizSpring Java Mall",
          "repo": "https://github.com/bizspring-open/BizSpring-Java-Mall",
          "vendor": "BizSpring",
          "versions": [
            {
              "lessThanOrEqual": "369e88c5cda36ddcea56742c335ee1bfe50e8156",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members\u0027 orders by supplying their orderId. Attackers can cancel victims\u0027 pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim\u0027s consent."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:49.839Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/bizspring-open/BizSpring-Java-Mall"
        },
        {
          "name": "VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-idor-via-member-order-cancel-and-receive"
        }
      ],
      "title": "BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110608",
    "datePublished": "2026-10-14T14:16:49.839Z",
    "dateReserved": "2026-10-14T13:07:22.907Z",
    "dateUpdated": "2026-10-14T14:16:49.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110607 (GCVE-0-2026-110607)

    Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 18:02
    VLAI
    Title
    BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
    Summary
    BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
    Severity
    7.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-14 18:02 UTC
    CWE
    • CWE-345 - Insufficient Verification of Data Authenticity
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6106 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    BizSpring BizSpring Shop Affected: 0 , ≤ cf22d39daaf17f430d8fc1fb698a2f6e515e1808 (git)
    		Create a notification for this product.
    BizSpring BizSpring Java Mall Affected: 0 , ≤ 369e88c5cda36ddcea56742c335ee1bfe50e8156 (git)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110607",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:02:11.286413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:02:45.647Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-shop-test-pay-endpoint-order-settlement-bypass"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/BizSpringSource/bizspring-shop-opensource",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/BizSpringSource/bizspring-shop-opensource",
          "product": "BizSpring Shop",
          "repo": "https://github.com/BizSpringSource/bizspring-shop-opensource",
          "vendor": "BizSpring",
          "versions": [
            {
              "lessThanOrEqual": "cf22d39daaf17f430d8fc1fb698a2f6e515e1808",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/bizspring-open/BizSpring-Java-Mall",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/bizspring-open/BizSpring-Java-Mall",
          "product": "BizSpring Java Mall",
          "repo": "https://github.com/bizspring-open/BizSpring-Java-Mall",
          "vendor": "BizSpring",
          "versions": [
            {
              "lessThanOrEqual": "369e88c5cda36ddcea56742c335ee1bfe50e8156",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members\u0027 orders."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:47.014Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-shop-test-pay-endpoint-order-settlement-bypass"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/PaymentController.java#L76-L84"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/service/impl/PaymentLogServiceImpl.java#L143-L169"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/PaymentController.java#L76-L84"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/BizSpringSource/bizspring-shop-opensource"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/bizspring-open/BizSpring-Java-Mall"
        },
        {
          "name": "VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-payment-bypass-via-test-post-pay-endpoint"
        }
      ],
      "title": "BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110607",
    "datePublished": "2026-10-14T14:16:47.014Z",
    "dateReserved": "2026-10-14T13:07:22.562Z",
    "dateUpdated": "2026-10-14T18:02:45.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}