CVE-2026-1112

Executive Summary

CVE-2026-1112 is an improper authorization vulnerability (CWE-285) in Sanluan PublicCMS up to version 5.202506.d. The flaw resides in the delete function of the TradeAddressController.java file within the Trade Address Deletion Endpoint. An attacker can manipulate the ids argument to delete trade addresses belonging to other users without proper authorization checks. The vulnerability is remotely exploitable, has a CVSS score of 5.4 (Medium), and a public exploit is available. No patch has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is Medium due to the low complexity and remote exploitability, but the impact is limited to unauthorized deletion of trade addresses, which may lead to data integrity issues and potential business disruption.

Deep Dive & Mechanics

The vulnerability is located in the TradeAddressController.java file within the publiccms-trade module. The delete method accepts an ids parameter (likely an array or list of address IDs) and performs deletion without verifying that the requesting user owns those addresses. The code likely iterates over the provided IDs and deletes them directly from the database, assuming the caller is authorized.

Root Cause: Missing or insufficient authorization check before deleting trade addresses. The controller does not validate that the ids belong to the authenticated user.

Attack Vector: An unauthenticated or low-privileged attacker can send a crafted HTTP request to the Trade Address Deletion Endpoint with arbitrary address IDs, causing deletion of other users' addresses.

Exploit Scenario:

1. Attacker identifies the endpoint (e.g., /tradeAddress/delete).
2. Attacker sends a POST request with ids=1,2,3 (or similar) to delete addresses belonging to other users.
3. The server deletes the addresses without verifying ownership.

Vulnerable vs. Patched Code

Vulnerable Code (PublicCMS <= 5.202506.d):

// TradeAddressController.java (vulnerable)
@PostMapping("/delete")
public ResponseEntity<?> delete(@RequestParam("ids") List<Long> ids) {
    // Missing authorization check
    tradeAddressService.delete(ids);
    return ResponseEntity.ok().build();
}

Patched Code (Hypothetical):

// TradeAddressController.java (patched)
@PostMapping("/delete")
public ResponseEntity<?> delete(@RequestParam("ids") List<Long> ids, Principal principal) {
    // Authorization check: ensure user owns the addresses
    for (Long id : ids) {
        TradeAddress address = tradeAddressService.getById(id);
        if (address == null || !address.getUserId().equals(principal.getName())) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
        }
    }
    tradeAddressService.delete(ids);
    return ResponseEntity.ok().build();
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• PublicCMS instance (version <= 5.202506.d) with trade address functionality enabled.
• Network access to the target endpoint.

Exploit Steps:

1. Identify the target endpoint (e.g., http://target.com/tradeAddress/delete).
2. Craft a POST request with the ids parameter containing target address IDs.
3. Send the request using curl or a similar tool.

Example Exploit (curl):

curl -X POST http://target.com/tradeAddress/delete \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "ids=1,2,3"

Expected Outcome: The specified trade addresses are deleted without authorization.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual deletion patterns on the /tradeAddress/delete endpoint.
• Log all requests to this endpoint and correlate with user sessions.
• Implement rate limiting and anomaly detection.

Mitigation:

• Apply input validation and authorization checks (see patched code).
• Use Web Application Firewall (WAF) rules to block suspicious requests.
• Enable audit logging for all delete operations.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /tradeAddress/delete with ids parameter containing multiple numeric values.
  • Unusual spike in deletion requests from a single IP.
• Logs:
  • Application logs showing deletion of trade addresses without corresponding user session.
  • Error logs indicating failed authorization checks (if patched).
• System:
  • Missing trade address records in the database.
  • User complaints about deleted addresses.

Detection Engineering

YARA Rule

rule CVE_2026_1112_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2026-1112 in PublicCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-1112"
    strings:
        $endpoint = "/tradeAddress/delete"
        $ids_param = "ids="
    condition:
        $endpoint and $ids_param
}

Sigma Rule

title: CVE-2026-1112 Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the Trade Address Deletion Endpoint with multiple IDs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/tradeAddress/delete'
        cs-uri-query|contains: 'ids='
    condition: selection
falsepositives:
    - Legitimate admin operations
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-1112 Exploit Attempt"; flow:to_server; content:"POST"; http_method; content:"/tradeAddress/delete"; http_uri; content:"ids="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Trade Address Deletion Endpoint if not required.
2. Apply input validation to ensure only authorized users can delete their own addresses.
3. Implement proper authorization checks as shown in the patched code example.
4. Monitor logs for suspicious deletion attempts.

Long-term Fix:

• Wait for an official patch from Sanluan. Since the vendor has not responded, consider forking the repository and applying the fix manually.
• Upgrade to a newer version if available.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /tradeAddress/delete with multiple IDs.
• Restrict access to the endpoint via network segmentation or authentication.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert