{"id":"CVE-2026-116274","kind":"vulnerability","aliases":["CVE-2026-116274"],"related":[],"title":"JIZHICMS: order payment handler lets remote users act on others' orders","description":"A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"JIZHICMS up to 2.5.6 has an improper authorization flaw in the Pay function of app/home/c/OrderController.php, where the orderno argument is not checked against the requesting user. A remote attacker can manipulate that argument to reach orders that are not theirs, and the exploit has been published.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","jizhicms","package","php","self-hosted"],"not_affected_if":["no-order-module"],"how_to_check":"- Check the installed JIZHICMS version and whether it is `2.5.6` or earlier\n- Review `app/home/c/OrderController.php` for the `Pay` function and whether it verifies that the order belongs to the logged-in user before using `orderno`","fix":"- No fixed version is named in the sources; unknown\n- Until a patch exists, restrict access to the order payment route or add an ownership check on `orderno` in the `Pay` function","status":"open","published_at":"2026-10-26T14:16:35+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:51+00:00","updated_at":"2026-10-26T14:32:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T14:32:51Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is named in the sources; unknown\n- Until a patch exists, restrict access to the order payment route or add an ownership check on `orderno` in the `Pay` function","reach":"internet","title":"JIZHICMS: order payment handler lets remote users act on others' orders","impact":"medium","summary":"JIZHICMS up to 2.5.6 has an improper authorization flaw in the Pay function of app/home/c/OrderController.php, where the orderno argument is not checked against the requesting user. A remote attacker can manipulate that argument to reach orders that are not theirs, and the exploit has been published.","category":"package","nicknames":[],"who_cares":["jizhicms","php","e-commerce","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote users may view or pay against other customers' orders","analyst_note":"Confirm the fixed version and whether the Pay endpoint requires a logged-in session, using the NVD entry and the JIZHICMS repository.","how_to_check":"- Check the installed JIZHICMS version and whether it is `2.5.6` or earlier\n- Review `app/home/c/OrderController.php` for the `Pay` function and whether it verifies that the order belongs to the logged-in user before using `orderno`","needs_analyst":true,"not_affected_if":["no-order-module"],"who_is_affected":"Sites running JIZHICMS up to 2.5.6 with the front-end order and payment features enabled are exposed, since the flaw is in the public order handler. Installations without the shop or order module, or running a newer release, can skip it; the sources do not say which configurations are affected beyond this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3342,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116274':14A,17A '-2026':13A,16A '2.5.6':30B,82C 'act':8A 'affect':84C 'app/home/c/ordercontroller.php':41B,91C 'argument':45B,59B,104C 'attack':55B,111C 'author':34B,109C 'check':48B 'commerc':20B 'compon':94C 'contact':131C 'cve':12A,15A 'disclos':120C 'disclosur':135C 'e':19B 'e-commerc':18B 'earli':132C 'end':97C 'exploit':69B,117C 'file':90C 'flaw':35B 'found':77C 'front':96C 'front-end':95C 'function':39B,86C 'handler':4A,99C 'host':26B 'improp':33B,108C 'jizhicm':1A,21B,27B,79C 'launch':114C 'lead':106C 'let':5A 'manipul':57B,101C 'may':125C 'order':2A,11A,62B,98C 'orderno':44B,105C 'other':10A 'packag':22B 'pay':38B,87C 'payment':3A 'php':23B 'public':123C 'publish':72B 'reach':61B 'remot':6A,54B,115C 'request':51B 'respond':139C 'self':25B 'self-host':24B 'use':127C 'user':7A,52B 'vendor':129C 'vulner':74C 'way':142C","nicknames":[],"mitigations":[],"who_affected":"Sites running JIZHICMS up to 2.5.6 with the front-end order and payment features enabled are exposed, since the flaw is in the public order handler. Installations without the shop or order module, or running a newer release, can skip it; the sources do not say which configurations are affected beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116274","severity":null,"published_at":"2026-10-26T14:16:35+00:00","modified_at":"2026-10-26T14:16:35+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}