This vulnerability in Sanluan PublicCMS 5.202506.d arises from business logic errors in the trade payment flow, specifically in the methods handling payment processing. These errors could be manipulated remotely to disrupt or bypass intended payment logic. The vulnerability does not require privileges or user interaction and has a medium severity rating (CVSS 6.9). The vendor has not issued any advisory or patch, and the exploit details are publicly available.

The vulnerability impacts the payment processing functionality of Sanluan PublicCMS, potentially allowing attackers to manipulate business logic remotely. This could lead to unauthorized payment actions or bypass of payment controls. However, the impact on confidentiality, integrity, and availability is limited as indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations using the affected version should monitor for vendor updates. Until a patch is available, consider restricting access to the payment-related endpoints or implementing compensating controls to validate payment transactions.