Bizspring Java Mall
Monthly
Authenticated buyers on BizSpring Shop and BizSpring Java Mall (BizSpring Shop through commit cf22d39daaf1; Java Mall through commit 369e88c5) can mark orders as paid without any real payment by first generating a payment log via /member/payment/load and then invoking the test/debug handler /member/payment/test_post_pay_{paymentLogSn} (PaymentController.testPostPay). The handler performs no authenticity verification of the payment (CWE-345), so an attacker can obtain goods for free, and by supplying another member's paymentLogSn can also settle other users' orders through an IDOR variant. The flaw is rated CVSS 4.0 base 7.1 (AV:N/AC:L/PR:L/UI:N, high integrity impact) and CVSS 3.1 7.1; it is not listed as confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis, although the underlying technique is documented in public HackMD writeups.
Authenticated members of BizSpring Shop can act on other members' orders through an insecure direct object reference in the OrderController cancel and receive handlers, which accept a user-supplied orderId without verifying ownership. By supplying a victim's orderId, an attacker can cancel a pending order (releasing allocated stock) or confirm receipt of a shipped order (advancing fulfilment and settlement) without the victim's consent. The issue also affects the related BizSpring Java Mall codebase; no public exploit identified at time of analysis and it is not in CISA KEV, with a CVSS 4.0 base score of 5.3 (assessed CVSS 3.1 5.3) reflecting limited integrity and availability impact confined to order state.
Authenticated buyers on BizSpring Shop and BizSpring Java Mall (BizSpring Shop through commit cf22d39daaf1; Java Mall through commit 369e88c5) can mark orders as paid without any real payment by first generating a payment log via /member/payment/load and then invoking the test/debug handler /member/payment/test_post_pay_{paymentLogSn} (PaymentController.testPostPay). The handler performs no authenticity verification of the payment (CWE-345), so an attacker can obtain goods for free, and by supplying another member's paymentLogSn can also settle other users' orders through an IDOR variant. The flaw is rated CVSS 4.0 base 7.1 (AV:N/AC:L/PR:L/UI:N, high integrity impact) and CVSS 3.1 7.1; it is not listed as confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis, although the underlying technique is documented in public HackMD writeups.
Authenticated members of BizSpring Shop can act on other members' orders through an insecure direct object reference in the OrderController cancel and receive handlers, which accept a user-supplied orderId without verifying ownership. By supplying a victim's orderId, an attacker can cancel a pending order (releasing allocated stock) or confirm receipt of a shipped order (advancing fulfilment and settlement) without the victim's consent. The issue also affects the related BizSpring Java Mall codebase; no public exploit identified at time of analysis and it is not in CISA KEV, with a CVSS 4.0 base score of 5.3 (assessed CVSS 3.1 5.3) reflecting limited integrity and availability impact confined to order state.