Payment Verification Bypass in BizSpring Shop

Executive Summary

CVE-2026-110607 is a payment verification bypass in BizSpring Shop and BizSpring Java Mall. It allows authenticated users to mark orders as paid without actual payment by exploiting the testPostPay endpoint. Attackers can generate a payment log and request a test payment URL to complete orders, even for other users' orders, due to missing verification checks like signature validation, payment gateway confirmation, and ownership verification.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual POST requests to /member/payment/test_post_pay_{paymentLogSn} endpoints. Check for payment logs marked as paid without corresponding payment gateway confirmations. Inspect order status transitions from PENDING_PAYMENT to PENDING_REVIEW without valid transactions. Look for sequential or predictable payment log serial numbers in database queries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables fraudulent order completion without payment, leading to financial losses for merchants. Attackers can obtain goods or services without paying or manipulate other users' orders. It may also cause inventory depletion, premature fund releases, and reputational damage for businesses relying on the affected platform.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with financial and data protection regulations. It allows unauthorized order completion without payment, risking financial fraud and data integrity breaches. GDPR may be affected if personal data is exposed during fraudulent transactions, while HIPAA could be violated if payment processing involves protected health information without proper controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately remove or disable the test_post_pay endpoint in PaymentController. Implement strict ownership checks for all order and payment operations. Add payment gateway callback verification with signature checks and amount validation. Make payment log serial numbers unpredictable and enforce member-scoped queries for all operations.

Useful 0 Not Useful 0