EUVD-2026-109787
GHSA-8276-8qph-c4qx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged front-end user
-
DeliveryAccess Pay endpoint in OrderController
-
ExploitTamper with orderno argument
-
ExecutionBypass order ownership check
-
ImpactManipulate another user's order (low integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated front-end account on the target JIZHICMS instance (PR:L); the attacker then calls the Pay function of the Order Handler and supplies an attacker-chosen orderno value to act on an order they do not own. Limiting factors: exploitation is gated on holding an authenticated account (so not exploitable by fully anonymous attackers), affects only installations running JIZHICMS up to and including 2.5.6, and the impact is confined to low integrity with no confidentiality or availability effect. No user interaction is required (UI:N) and no non-default configuration is indicated in the description. |
| Impact | This is a moderate-severity improper-authorization (IDOR) flaw in JIZHICMS's front-end order handler, and the signals are internally consistent rather than conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity issue that requires a low-privileged authenticated account (PR:L), with impact limited to low integrity (VI:L) and no confidentiality or availability effect (VC:N/VA:N) and no scope change to other systems. The 5.3 base score reflects this constrained impact, not a critical break. There is no CISA KEV entry and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation; the only exploitation signal is the Exploit Maturity E:P (proof-of-concept) and a single GitHub reference. The vuln.today decision label is 'this_month', i.e. a routine remediation cadence rather than an emergency. The practical priority is tempered further by the vendor being unresponsive, meaning no official fix is referenced - defenders may need to mitigate at the application/access-control layer. Net: a real but bounded authorization defect worth patching on a normal cycle, not a drop-everything issue. |
| Exploit ScenarioDerived | A low-privileged authenticated user of a JIZHICMS site invokes the Pay function of the front-end Order Handler and substitutes a different value for the orderno argument, causing the application to act on an order that does not belong to them due to missing ownership checks. A public PoC reference exists (the riyuedeqi/jizhicms-order-idor repository) but it is not verified as working exploit code, and the concrete HTTP request details are not described in the available sources. Because the CVSS vector is AV:N/AC:L, the manipulation is performed over the network with low complexity once the attacker holds a valid account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Improper authorization in JIZHICMS's front-end order handler (the Pay function in app/home/c/OrderController.php) allows a low-privileged authenticated user to supply an attacker-chosen orderno and act on orders belonging to other users, affecting releases up to and including 2.5.6. Exploitation requires a valid front-end account (CVSS 3.1 PR:L, AV:N, AC:L, UI:N) and is limited to low integrity impact with no confidentiality or availability effect. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV listing appears in the supplied intelligence, while the CVSS 4.0 vector carries E:P exploit maturity. The vendor was contacted about the disclosure and did not respond, and priority is set to this month's remediation cycle rather than immediate emergency action.
RemediationAI
No vendor-released patch or fixed version is identified at time of analysis: the vendor was contacted early about the disclosure and did not respond, so no upgrade target can be cited. Because the flaw is a missing ownership check rather than a configuration weakness, the direct compensating control is a code change in app/home/c/OrderController.php: before executing Pay, resolve the orderno to its order record and abort unless the record's owning user matches the authenticated session user, treating the identifier as untrusted input rather than a trusted reference. If modifying the application is not feasible in the short term, the exposure can be narrowed by preventing untrusted parties from obtaining front-end accounts, since the assessed exploitation conditions require a valid low-privileged authenticated account; this reduces but does not eliminate risk from existing or self-registered users and has the side effect of limiting legitimate customer sign-ups. Blocking or restricting access to the front-end order Pay endpoint at a reverse proxy or WAF is another interim option, at the cost of breaking checkout and payment flows for legitimate shoppers, so it should only be used where the order function can be taken offline. Monitor the VulDB entries at https://vuldb.com/vuln/426303 and https://vuldb.com/cve/CVE-2026-116274 for a vendor fix, and prioritize this within the current monthly remediation cycle rather than as an emergency change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JIZHICMS is a PHP content management system whose front-end storefront is implemented as an MVC module; app/home/c/OrderController.php handles order lifecycle actions and its Pay function resolves the target order from a client-supplied orderno parameter. The root cause is classified as CWE-285 (Improper Authorization): the handler performs the state-changing pay operation on the referenced order without confirming that the order actually belongs to the authenticated session user, so a legitimate but low-privileged account can reference another customer's order identifier and have the action applied to it. The supplied CPE string (cpe:2.3:a:n/a:jizhicms:*:*:*:*:*:*:*:*) has a placeholder vendor and an unbounded version wildcard, so it does not itself constrain the affected range; the ceiling of 2.5.6 comes from the vulnerability description. The trigger conditions beyond supplying a crafted orderno, and any further preconditions such as order state or payment-module configuration, are not described in the available sources. The CVSS 4.0 vector rates exploit maturity E:P, consistent with the publicly disclosed PoC reference, which is a repository link that has not been verified as functional exploit code.
Know when Jizhicms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable (AV:N), low complexity (AC:L), needs a low-privileged account (PR:L), no user interaction; improper authorization lets an attacker alter another user's order, giving low integrity impact only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
jizhiCMS 2.5 suffers from a File upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to
Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsContr
A vulnerability was found in JIZHICMS 2.4.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
jizhicms v2.3.1 has SQL injection in the background. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/upda
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in a
Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in
Jizhicms versions up to 1.6.7 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploade
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component. Rated
Exploit-DB