Executive brief
Sanluan PublicCMS, a content management system, contains a security flaw in its trade module that handles shipping addresses. An unauthenticated attacker can remotely access the system to view sensitive customer information, including full names, shipping addresses, and phone numbers. This could lead to large-scale data theft and privacy violations for users of the platform.
Technical details
A missing authentication vulnerability exists in the TradeAddressListDirective and TradeAddressDirective components of Sanluan PublicCMS. The affected directives inherit from AbstractTemplateDirective but fail to override the needAppToken() or needUserToken() methods, leaving the /api/directive/trade/addressList and /api/directive/trade/address endpoints accessible to unauthenticated users. By manipulating the 'userId' or 'id' parameters in a GET request, a remote attacker can bypass authorization checks to retrieve TradeAddress entity data. This data includes sensitive fields such as the addressee name, physical address, and telephone number. A public exploit is available, and the vendor has reportedly not responded to disclosure attempts.
Affected products
- Sanluan PublicCMS 5.202506.d
Timeline
- 2026-05-17: advisory: Vulnerability disclosed via VulDB and NVD