Live › vulnerability › CVE-2026-116274
Go to dashboardJIZHICMS up to 2.5.6 has an improper authorization flaw in the Pay function of app/home/c/OrderController.php, where the orderno argument is not checked against the requesting user. A remote attacker can manipulate that argument to reach orders that are not theirs, and the exploit has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Sites running JIZHICMS up to 2.5.6 with the front-end order and payment features enabled are exposed, since the flaw is in the public order handler. Installations without the shop or order module, or running a newer release, can skip it; the sources do not say which configurations are affected beyond this.
No product ranges from the sources yet.
2.5.6 or earlierapp/home/c/OrderController.php for the Pay function and whether it verifies that the order belongs to the logged-in user before using ordernoorderno in the Pay functionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116274")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.