CVE-2019-25778: high-severity vulnerability in SeaCMS
SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
63Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 8.8epss 0.5%
from disclosure to weapon
Published on NVDOct 22
VulnCheckOct 22
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
SeaCMS · SeaCMSpublic PoCs found — 1
cve_referencewww.uedbox.com/post/54561/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.