This vulnerability in Sanluan PublicCMS 5.202506.d impacts the TradeOrderController.pay, TradePaymentController.pay, and AccountGatewayComponent.pay functions within the Trade Payment Flow component. The flaw allows remote attackers to manipulate business logic, potentially disrupting or bypassing intended payment processes. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vendor has not issued a patch or advisory, and the exploit code has been publicly disclosed.

Successful exploitation could lead to unauthorized manipulation of payment processes within the affected CMS, potentially causing financial or transactional inconsistencies. However, the impact is limited to business logic errors without direct indication of data breach or system compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing compensating controls such as additional validation on payment workflows and monitoring for suspicious payment activity until an official patch is released.