| शीर्षक | PublicCMS V5.202506.d business logic flaw |
|---|
| विवरण | PublicCMS contains a pre-auth business logic flaw in its order payment workflow that allows anonymous attackers to force a victim’s pending order to be paid using the victim’s internal account balance. Because the application does not require login or verify ownership in either the payment initiation or execution steps, an attacker can trigger unauthorized balance deduction and mark the victim’s order as paid simply by visiting a crafted URL.
|
|---|
| स्रोत | ⚠️ https://vulnplus-note.wetolink.com/share/ayeMf4xWK0ZZ |
|---|
| उपयोगकर्ता | vulnplusbot (UID 96250) |
|---|
| सबमिशन | 22/04/2026 10:38 AM (1 महीना पहले) |
|---|
| संयम | 16/05/2026 12:36 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 364326 [Sanluan PublicCMS 5.202506.d Trade Payment Flow TradeOrderController.java] |
|---|
| अंक | 20 |
|---|