CVE-2026-110607: BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/testpostpay{paymentLogSn} to obtain goods without paying or settle other members' orders.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated buyer can exploit it remotely. No user interaction is required, and the attacker only needs a buyer account plus access to the affected payment endpoints.
What does an attacker need to do to bypass payment?
The attacker can generate a payment log through /member/payment/load, then call /member/payment/test_post_pay_{paymentLogSn}. This can mark an order as paid without payment and may also be used to settle another member's order.
Are unauthenticated users affected?
The provided information identifies authentication as required. It does not indicate that an unauthenticated user can invoke the payment bypass.
How can defenders check for possible exploitation?
Review payment activity for requests to /member/payment/load followed by /member/payment/test_post_pay_{paymentLogSn}, especially where an order was marked paid without a corresponding legitimate payment. Also investigate cases in which a payment log or settlement is associated with a different member's order.