| Title | fushengqian fuint up to cb498ad2 Improper Access Controls |
|---|
| Description | A vulnerability was found in fushengqian fuint and fuintCatering. Affected is the function confirm of the file MerchantOrderController.java (order verification / 核销), reached under the merchant API. The manipulation leads to improper access control: the downstream OrderServiceImpl.updateOrder only rejects the DELETED status and does not verify the order is in a verifiable (paid, not refunded/cancelled) state before setting it to COMPLETE. In addition, when the order has no stored verify code, the StringUtil.isEmpty(mtOrder.getVerifyCode()) branch accepts any submitted verification code. A store-staff account can therefore complete unpaid, cancelled or refunded orders; a refunded order keeps payStatus B and is then counted by the commission job. The attack can be launched remotely. Authentication as a store-staff user is required. Suggested fix: check the order status/payStatus before completing, and remove the empty-stored-code branch. |
|---|
| Source | ⚠️ https://github.com/fushengqian/fuint/blob/cb498ad2e13268ad0f2ecdbda7795b4174f864f8/fuint-application/src/main/java/com/fuint/module/merchantApi/controller/MerchantOrderController.java#L137-L163 |
|---|
| User | Y1Daa (UID 102157) |
|---|
| Submission | 10/15/2026 10:21 (24 days ago) |
|---|
| Moderation | 11/08/2026 15:55 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 432897 [fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f Order Verification MerchantOrderController.java confirm access control] |
|---|
| Points | 20 |
|---|