Executive brief
A business logic vulnerability in Sanluan PublicCMS allows unauthorized individuals to manipulate the payment process. An attacker can remotely force a victim's pending order to be paid using the victim's own internal account balance without their consent. This can lead to unauthorized financial transactions and the depletion of user account funds.
Technical details
A business logic error exists in the Trade Payment Flow component of PublicCMS, specifically within the TradeOrderController.pay, TradePaymentController.pay, and AccountGatewayComponent.pay functions. The application fails to perform authentication or ownership validation when initiating or executing a payment. An unauthenticated attacker can supply a victim's order ID to the payment endpoint; the system then creates a payment record and deducts funds from the internal balance associated with the order owner (payment.userId) without verifying the identity of the requester. This allows for remote, pre-authentication exploitation of financial transactions. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- Sanluan PublicCMS 5.202506.d
Timeline
- 2026-05-17: advisory: Vulnerability disclosed via VulDB and NVD
- 2026-05-17: disclosed: Public disclosure of the exploit details