| Title | fushengqian fuint & fuintCatering up to cb498ad2 Improper Validation |
|---|
| Description | A vulnerability was found in fushengqian fuint and fuintCatering. Affected is the function receipt of the file ClientOrderController.java (client-side "confirm receipt"). It only checks that the order belongs to the current member and then sets the order status to RECEIVED; the downstream OrderServiceImpl.updateOrder only rejects the DELETED status. As a result, a logged-in member can force any of their own orders, including unpaid, cancelled or refunded ones, into the RECEIVED state, for example to inflate valid-consumption statistics used by membership tag rules. The attack can be launched remotely. Authentication as a member is required and the impact is limited to the member's own orders. Suggested fix: check the order is in a shipped or deliverable state before setting RECEIVED. |
|---|
| Source | ⚠️ https://github.com/fushengqian/fuint/blob/cb498ad2e13268ad0f2ecdbda7795b4174f864f8/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientOrderController.java#L140-L154 |
|---|
| User | Y1Daa (UID 102157) |
|---|
| Submission | 10/15/2026 10:42 (24 days ago) |
|---|
| Moderation | 11/08/2026 15:55 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 432899 [fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f ClientOrderController.java receipt state issue] |
|---|
| Points | 20 |
|---|