A flaw exists in the TradeRefundService.updateAmound method of Sanluan PublicCMS, where an attacker can manipulate the refundId parameter to bypass ordinary authorization checks. By providing an arbitrary value for refundId, the service will process the refund without verifying that the requester has the appropriate privileges. The vulnerability aligns with CWE‑285 (Authorization Bypass Through Privileged Credential) and CWE‑639 (Authorization Bypass Through User Controllable Input). This allows malicious users to request refunds on transactions they do not own, potentially draining the site’s funds or depleting inventory. The affected product is Sanluan PublicCMS versions 4.x, 5.x and 6.x. The vulnerability resides in the publiccms-trade module, specifically in the TradeRefundService.updateAmound method. Users of these versions are at risk unless mitigations are applied. The CVSS score of 5.3 indicates a moderate severity level. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. However, the exploit is publicly available and can be initiated remotely by sending a crafted request that alters the refundId parameter. The attack does not require local privileges or prior authentication, making it a straightforward threat for any exposed instance of the affected CMS.

Sanluan: PublicCMS 4.x, 5.x, 6.x. The vulnerability affects the TradeRefundService.updateAmound function in the publiccms-trade component of each version.

The moderate CVSS score reflects that the attack path is simple and the authorization bypass could lead to significant financial loss. Though the EPSS score is unavailable, the publicly released exploit demonstrates a real-world exploitation risk. Because the vulnerability is not yet catalogued in KEV, defenders should treat it as a known vulnerability with an active exploit and prioritize remediation accordingly.