Description
A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-26
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Access
Action: Patch
AI Analysis

Impact

The Pay function in the OrderController.php file of JIZHICMS accepts an orderno that can be manipulated to bypass normal authorization checks, which allows an attacker to perform operations such as initiating payments or accessing order details without appropriate user privileges. The problem stems from improper validation and access control and is classified under CWE-266 and CWE-285.

Affected Systems

JIZHICMS installations up to version 2.5.6 are affected. Administrators should verify the version of their JIZHICMS deployment and plan for an upgrade once a newer release or patch becomes available.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available. This vulnerability is not listed in the CISA KEV catalog, but the exploit has been publicly disclosed, meaning attackers can target the Pay endpoint remotely and exploit it without additional setup. Until a vendor fix or a deployable workaround is in place, the risk remains significant.

Generated by OpenCVE AI on October 26, 2026 at 15:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to a JIZHICMS release newer than 2.5.6 or apply any vendor‑provided patch.
  • Implement strict validation for the orderno parameter to enforce proper authorization and prevent data tampering.
  • Restrict access to the Pay endpoint so that only authenticated and authorized users can invoke it, ensuring role‑based access control is correctly enforced.

Generated by OpenCVE AI on October 26, 2026 at 15:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title JIZHICMS Front-end Order OrderController.php pay improper authorization
First Time appeared Jizhicms
Jizhicms jizhicms
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:jizhicms:jizhicms:*:*:*:*:*:*:*:*
Vendors & Products Jizhicms
Jizhicms jizhicms
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Jizhicms Jizhicms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T12:15:07.762Z

Reserved: 2026-10-25T18:07:11.015Z

Link: CVE-2026-116274

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-26T14:16:35.170

Modified: 2026-10-26T18:35:08.450

Link: CVE-2026-116274

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:00:18Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization