| Title | fushengqian fuintCatering up to 06e744dd Improper Access Controls |
|---|
| Description | A vulnerability has been found in fushengqian fuintCatering. Affected is the function updateCommissionCash of CommissionCashServiceImpl, reached via the backend endpoint BackendCommissionCashController save. The status field is taken directly from the request and set with no state guard, whereas the payToBalance function rejects records in the PAYED or CANCEL state. As a result, a PAYED commission-cash (withdrawal) record can be reset to WAIT and payToBalance re-run, enabling a double payout of the commission. The attack can be launched remotely. Authentication as a backend account with the commission:cash:index permission is required. Suggested fix: forbid editing the status of PAYED or CANCEL records, mirroring the guard in payToBalance. |
|---|
| Source | ⚠️ https://github.com/fushengqian/fuintCatering/blob/06e744dd5d1f1a754861cc322fbb84b7d5edd25b/fuintBackend/fuint-application/src/main/java/com/fuint/module/backendApi/controller/commission/BackendCommissionCashController.java#L106 |
|---|
| User | Y1Daa (UID 102157) |
|---|
| Submission | 10/15/2026 10:39 (24 days ago) |
|---|
| Moderation | 11/08/2026 15:55 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 432901 [fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133 CommissionCashServiceImpl.java updateCommissionCash status access control] |
|---|
| Points | 20 |
|---|