BizSpring Shop contains a payment verification bypass that lets authenticated buyers invoke the test_post_pay handler to mark orders as paid without any real payment. This flaw allows an attacker to create a payment log via /member/payment/load and then call /member/payment/test_post_pay_{paymentLogSn} to receive goods or settle another member’s order, effectively stealing merchandise or services.

The vulnerability is present in BizSpring Shop and the related BizSpring Java Mall application, specifically in the code committed under the hash cf22d39daaf1. The affected components include the PaymentController.testPostPay endpoint and the PaymentLogService utilized for creating payment logs. No specific version information is available for the affected releases.

The CVSS base score is 7.1, indicating substantial risk. The EPSS score of 0.00305 indicates a very low probability of exploitation today, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need only authenticated access to the shop APIs and do not require any advanced privilege escalation; the API calls are simple HTTP requests, making exploitation straightforward for any user with a valid account.