| Title | fushengqian fuint up to cb498ad2 Improper Validation |
|---|
| Description | A vulnerability was identified in fushengqian fuint and fuintCatering. Affected is the function aliPayCallback of the file ClientPayController.java. Unlike weixinCallback, which first checks that the order is in the CREATED state, aliPayCallback calls paymentCallback immediately after signature verification. The downstream OrderServiceImpl.setOrderPayed only guards against payStatus == SUCCESS (idempotency) and does not check whether the order was cancelled, so a late or replayed (signature-valid) Alipay callback can revive a cancelled order to PAID, after which previously returned points and coupons can be reused. Because the callback channel is signature-verified, this is a missing state precondition rather than a forgery. The attack can be launched remotely; exploitation is considered difficult as it requires a late or replayed callback on a cancelled order. Suggested fix: add the CREATED precondition to aliPayCallback to match weixinCallback. |
|---|
| Source | ⚠️ https://github.com/fushengqian/fuint/blob/cb498ad2e13268ad0f2ecdbda7795b4174f864f8/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientPayController.java#L262-L271 |
|---|
| User | Y1Daa (UID 102157) |
|---|
| Submission | 10/15/2026 10:33 (24 days ago) |
|---|
| Moderation | 11/08/2026 15:55 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 432898 [fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f Alipay Callback ClientPayController.java aliPayCallback behavioral workflow] |
|---|
| Points | 20 |
|---|