CVE-2026-110607: Insufficient Verification of Data Authenticity in BizSpring BizSpring Shop

BizSpring Shop version 0 contains a payment verification bypass vulnerability identified as CVE-2026-110607. Authenticated users can exploit the PaymentController.testPostPay endpoint by generating a payment log via /member/payment/load and then invoking /member/payment/test_post_pay_{paymentLogSn} to mark orders as paid without actual payment. This flaw allows attackers to obtain goods without paying or to settle orders belonging to other members, due to insufficient verification of data authenticity in the payment workflow.

The vulnerability enables authenticated attackers to bypass payment verification, potentially resulting in unauthorized acquisition of goods or unauthorized settlement of other users' orders. This can lead to financial loss for merchants and undermine trust in the payment system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the PaymentController.testPostPay handler and monitor for suspicious activity involving payment log generation and test_post_pay requests.