i think createAction is the Action class where show is the method which returns the logic
Correct. In this case, it's likely the action is being defined as a Spring bean in a Spring configuration file.
That's a guess; I'm guessing that because the class name,
createAction, does not follow any Java naming conventions (classes belong in a package, and class names should start with an uppercase letter). It is, however, a typical Spring bean name.
[...] the result type is tiles what does it mean?
It means the tiles plugin is being used. (Most likely. It
could mean the developer has implemented their
own "tiles" result type, but that would be a little unusual.
box.location.start is the name of the tile definition that will be rendered.
when result name="verificationRequired" "/" is the result and what does it mean?
This means when the action method returns the string
verificationRequired the result rendered will be a redirect to the root of the application.