CVE-2019-25778: SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote, unauthenticated attacker able to send GET requests to the affected SeaCMS endpoint can attempt exploitation. No credentials or user interaction are required.
What endpoint and input are involved?
The affected endpoint is /comment/api/index.php. The injection point is the rlist[] array parameter supplied in a GET request.
What could an attacker obtain or do?
An attacker can manipulate database queries and extract database information through error messages. The reported technique uses crafted rlist[] values with backtick-quoted variables and extractvalue.
Is there evidence of exploitation in the wild?
Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.