CVE-2023-43216
📋 TL;DR
SeaCMS V12.9 contains an arbitrary file write vulnerability in admin_ip.php that allows attackers to write malicious files to the server. This affects all SeaCMS V12.9 installations with the vulnerable component accessible. Attackers can potentially achieve remote code execution or compromise the entire system.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, data theft, defacement, or ransomware deployment.
Likely Case
Webshell upload leading to persistent backdoor access, data exfiltration, or lateral movement within the network.
If Mitigated
Limited impact if proper file permissions, web application firewalls, and network segmentation are in place.
🎯 Exploit Status
Exploitation requires admin access or authentication bypass to reach vulnerable component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V12.9+ or later patched version
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Update to latest SeaCMS version. 2. If update unavailable, manually patch admin_ip.php with input validation and file path restrictions. 3. Remove or restrict access to vulnerable component.
🔧 Temporary Workarounds
Restrict admin panel access
allLimit access to admin_ip.php and admin panel to trusted IPs only
# In .htaccess or web server config
Deny from all
Allow from 192.168.1.0/24
File permission hardening
linuxSet strict file permissions on web directories to prevent arbitrary writes
chmod 755 /var/www/seacms/
chmod 644 /var/www/seacms/*.php
chown www-data:www-data /var/www/seacms/
🧯 If You Can't Patch
- Implement web application firewall (WAF) with file upload and path traversal rules
- Disable or remove admin_ip.php component entirely
🔍 How to Verify
Check if Vulnerable:
Check if SeaCMS version is V12.9 and admin_ip.php exists in admin directoryCheck Version:
Check SeaCMS configuration files or admin panel for version informationVerify Fix Applied:
Verify SeaCMS version is updated beyond V12.9 and test file write functionality is restricted📡 Detection & Monitoring
Log Indicators:
- Unusual file writes in web directories
- Multiple failed/successful admin login attempts
- Access to admin_ip.php with POST parameters
Network Indicators:
- HTTP POST requests to admin_ip.php with file path parameters
- Unexpected file uploads to web server
SIEM Query:
source="web_server" AND (uri="*/admin_ip.php" OR method="POST" AND uri="*/admin/*")