CVE-2026-1112
📋 TL;DR
This CVE describes an improper authorization vulnerability in Sanluan PublicCMS's trade address deletion endpoint. Attackers can remotely manipulate the 'ids' parameter to delete trade addresses without proper authorization. All users running PublicCMS up to version 5.202506.d are affected.
💻 Affected Systems
- Sanluan PublicCMS
📦 What is this software?
Publiccms by Publiccms
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized deletion of trade addresses could disrupt business operations, cause data loss, and potentially enable further attacks if combined with other vulnerabilities.
Likely Case
Attackers delete trade addresses, causing operational disruption and requiring manual restoration from backups.
If Mitigated
With proper authorization controls, only legitimate users can delete trade addresses, preventing unauthorized data modification.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making exploitation straightforward for attackers with some access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a version beyond 5.202506.d if available, or implement workarounds.
🔧 Temporary Workarounds
Disable Trade Address Deletion Endpoint
allTemporarily disable or restrict access to the vulnerable endpoint to prevent exploitation.
# Modify web server configuration to block access to /trade/address/delete endpoint
# Example for Apache: RewriteRule ^/trade/address/delete - [F]
# Example for Nginx: location ~ /trade/address/delete { deny all; }
Implement Authorization Check
allAdd proper authorization validation in the delete function to ensure only authorized users can delete trade addresses.
# Modify TradeAddressController.java to include authorization checks
# Example: if (!user.hasPermission("delete_address")) { return "unauthorized"; }
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the PublicCMS instance from untrusted networks.
- Monitor and audit all delete operations on trade addresses for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check if PublicCMS version is 5.202506.d or earlier by examining version files or admin panel.Check Version:
# Check version in PublicCMS installation directory: cat version.txt or check admin panelVerify Fix Applied:
Test the trade address deletion endpoint with unauthorized users to ensure proper authorization is enforced.📡 Detection & Monitoring
Log Indicators:
- Unusual delete requests to /trade/address/delete endpoint
- Failed authorization attempts for trade address deletion
Network Indicators:
- HTTP POST requests to /trade/address/delete with unexpected parameters
SIEM Query:
source="web_server" AND uri="/trade/address/delete" AND response_code=200 AND user NOT IN authorized_users