Sanluan
Monthly
Authorization bypass in Sanluan PublicCMS 4.x, 5.x and 6.x allows an authenticated low-privilege user to manipulate the refundId argument handled by TradeRefundService.updateAmound and operate on refund records that belong to other accounts. Only deployments that include and actively use the optional publiccms-trade e-commerce/refund module are exposed; core CMS content-serving instances are not affected by this code path. Severity is medium (CVSS 4.0 base 5.3, assessed CVSS 3.1 5.3) and the disclosure states the exploit has been made public, so a public PoC/exploit reference exists, though it is not independently verified as working exploit code. There is no CISA KEV entry, no fixed version is listed in the available evidence, and the vendor did not respond to the report, so no vendor mitigation is stated.
Authorization bypass in Sanluan PublicCMS up to and including 6.202506.e lets an authenticated administrative user read user and department records outside their authorized scope by tampering with the userId or deptId parameter handled by the exportExcel/exportData functions. Because the server never verifies that the requested identifier falls within the caller's own department or permission scope (CWE-639), a low-privileged backend account can pull exports it should not see; the impact is confidentiality-only with no modification or denial-of-service component. Publicly available exploit code exists (a PoC published in the GitHub CVERequest repository), but the flaw is not confirmed actively exploited (CISA KEV), the vendor did not respond to the disclosure, and no vendor patch is available - making this a low-priority issue despite being remotely reachable.
Server-Side Template Injection in PublicCMS 5.202506.d allows authenticated remote attackers to execute arbitrary code and access sensitive information via the templateResult API endpoint. The vulnerability exists in the TemplateResultDirective.java component, where the templateContent parameter lacks proper sanitization, enabling template engine injection attacks. Publicly available exploit code exists (VulnPlus disclosure), and the vendor has not responded to coordinated disclosure attempts, leaving users without an official patch.
Hard-coded cryptographic key in Sanluan PublicCMS 5.202506.d allows remote attackers to compromise data integrity through the SafeConfigComponent's getSignKey function. The vulnerability (CWE-321) enables manipulation of the privatefile_key argument, permitting unauthenticated network-based attacks with low complexity. Public exploit code is available per VulDB submission 809917, significantly lowering the skill barrier for exploitation despite the medium CVSS 5.5 score. EPSS data unavailable; not listed in CISA KEV, suggesting targeted rather than widespread exploitation at time of analysis.
Business logic flaws in PublicCMS 5.202506.d trade payment controller allow unauthenticated remote attackers to manipulate payment processing workflows, potentially enabling payment bypass or unauthorized transaction modifications. Publicly available exploit code exists demonstrating the attack. The vulnerability affects three payment-related functions (TradeOrderController.pay, TradePaymentController.pay, AccountGatewayComponent.pay) in the publiccms-trade module. Vendor was notified but did not respond, and no patch has been announced.
Authentication bypass in Sanluan PublicCMS 5.202506.d allows remote unauthenticated attackers to access arbitrary user trade address data via manipulation of userId/id parameters in the TradeAddressListDirective component. Public exploit code exists (CVSS E:P), enabling unauthorized disclosure of confidential address information including names, phone numbers, and shipping details. EPSS data unavailable; not listed in CISA KEV. Vendor non-responsive to disclosure.
Uncontrolled resource consumption in Sanluan PublicCMS versions 6.202506.a through 6.202506.d enables low-privileged remote attackers to trigger denial-of-service conditions by manipulating the ZipSecureFile.setMinflateRatio function within the document-to-HTML conversion utility DocToHtmlUtils.java. The flaw (CWE-400) causes the server to exhaust resources when processing attacker-controlled input through the affected code path. No public exploit exists, EPSS sits at 0.03% (10th percentile), SSVC confirms no known exploitation and non-automatable attack profile - real-world priority is low for most deployments, though the vendor's non-response to disclosure leaves patch status unresolved.
Cleartext credential storage in PublicCMS 6.202506.a through 6.202506.d exposes user-supplied passwords to any party with read access to the application's log files. The failed login handler (`log_login` in `LoginAdminController.java`) persists the raw `errorPassword` argument to disk without obfuscation, meaning that mistyped or probed passwords accumulate in plaintext logs indefinitely. No public exploit code exists and CISA has not listed this in KEV; EPSS sits at 0.01% (2nd percentile), confirming negligible observed exploitation activity at time of analysis.
Authorization bypass in Sanluan PublicCMS 4.x, 5.x and 6.x allows an authenticated low-privilege user to manipulate the refundId argument handled by TradeRefundService.updateAmound and operate on refund records that belong to other accounts. Only deployments that include and actively use the optional publiccms-trade e-commerce/refund module are exposed; core CMS content-serving instances are not affected by this code path. Severity is medium (CVSS 4.0 base 5.3, assessed CVSS 3.1 5.3) and the disclosure states the exploit has been made public, so a public PoC/exploit reference exists, though it is not independently verified as working exploit code. There is no CISA KEV entry, no fixed version is listed in the available evidence, and the vendor did not respond to the report, so no vendor mitigation is stated.
Authorization bypass in Sanluan PublicCMS up to and including 6.202506.e lets an authenticated administrative user read user and department records outside their authorized scope by tampering with the userId or deptId parameter handled by the exportExcel/exportData functions. Because the server never verifies that the requested identifier falls within the caller's own department or permission scope (CWE-639), a low-privileged backend account can pull exports it should not see; the impact is confidentiality-only with no modification or denial-of-service component. Publicly available exploit code exists (a PoC published in the GitHub CVERequest repository), but the flaw is not confirmed actively exploited (CISA KEV), the vendor did not respond to the disclosure, and no vendor patch is available - making this a low-priority issue despite being remotely reachable.
Server-Side Template Injection in PublicCMS 5.202506.d allows authenticated remote attackers to execute arbitrary code and access sensitive information via the templateResult API endpoint. The vulnerability exists in the TemplateResultDirective.java component, where the templateContent parameter lacks proper sanitization, enabling template engine injection attacks. Publicly available exploit code exists (VulnPlus disclosure), and the vendor has not responded to coordinated disclosure attempts, leaving users without an official patch.
Hard-coded cryptographic key in Sanluan PublicCMS 5.202506.d allows remote attackers to compromise data integrity through the SafeConfigComponent's getSignKey function. The vulnerability (CWE-321) enables manipulation of the privatefile_key argument, permitting unauthenticated network-based attacks with low complexity. Public exploit code is available per VulDB submission 809917, significantly lowering the skill barrier for exploitation despite the medium CVSS 5.5 score. EPSS data unavailable; not listed in CISA KEV, suggesting targeted rather than widespread exploitation at time of analysis.
Business logic flaws in PublicCMS 5.202506.d trade payment controller allow unauthenticated remote attackers to manipulate payment processing workflows, potentially enabling payment bypass or unauthorized transaction modifications. Publicly available exploit code exists demonstrating the attack. The vulnerability affects three payment-related functions (TradeOrderController.pay, TradePaymentController.pay, AccountGatewayComponent.pay) in the publiccms-trade module. Vendor was notified but did not respond, and no patch has been announced.
Authentication bypass in Sanluan PublicCMS 5.202506.d allows remote unauthenticated attackers to access arbitrary user trade address data via manipulation of userId/id parameters in the TradeAddressListDirective component. Public exploit code exists (CVSS E:P), enabling unauthorized disclosure of confidential address information including names, phone numbers, and shipping details. EPSS data unavailable; not listed in CISA KEV. Vendor non-responsive to disclosure.
Uncontrolled resource consumption in Sanluan PublicCMS versions 6.202506.a through 6.202506.d enables low-privileged remote attackers to trigger denial-of-service conditions by manipulating the ZipSecureFile.setMinflateRatio function within the document-to-HTML conversion utility DocToHtmlUtils.java. The flaw (CWE-400) causes the server to exhaust resources when processing attacker-controlled input through the affected code path. No public exploit exists, EPSS sits at 0.03% (10th percentile), SSVC confirms no known exploitation and non-automatable attack profile - real-world priority is low for most deployments, though the vendor's non-response to disclosure leaves patch status unresolved.
Cleartext credential storage in PublicCMS 6.202506.a through 6.202506.d exposes user-supplied passwords to any party with read access to the application's log files. The failed login handler (`log_login` in `LoginAdminController.java`) persists the raw `errorPassword` argument to disk without obfuscation, meaning that mistyped or probed passwords accumulate in plaintext logs indefinitely. No public exploit code exists and CISA has not listed this in KEV; EPSS sits at 0.01% (2nd percentile), confirming negligible observed exploitation activity at time of analysis.