CVE-2023-44169
📋 TL;DR
SeaCMS V12.9 contains an arbitrary file write vulnerability in admin_notify.php that allows attackers to write malicious files to the server. This affects all SeaCMS V12.9 installations with the admin panel accessible. Attackers can potentially achieve remote code execution by writing web shells or other malicious files.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Web shell deployment leading to data theft, defacement, or use as a foothold for further attacks.
If Mitigated
Limited impact if file write is restricted to non-executable locations or proper file permissions prevent execution.
🎯 Exploit Status
Exploitation requires admin access, but if credentials are compromised or weak, exploitation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V12.9+ (specific patch version not specified in references)
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Update to the latest SeaCMS version. 2. If update not available, manually patch admin_notify.php to validate and sanitize file write operations. 3. Apply vendor-provided security patches.
🔧 Temporary Workarounds
Restrict admin panel access
allLimit access to admin panel to trusted IP addresses only
# Configure web server (e.g., Apache .htaccess or Nginx config) to restrict /admin/ path
File permission hardening
linuxSet strict file permissions on web directories to prevent arbitrary writes
chmod 755 /var/www/seacms/
chmod 644 /var/www/seacms/*.php
chown www-data:www-data /var/www/seacms/
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious file write attempts
- Monitor file system changes in web directories and alert on unauthorized writes
🔍 How to Verify
Check if Vulnerable:
Check if SeaCMS version is V12.9 and review admin_notify.php for insufficient file write validationCheck Version:
Check SeaCMS version in admin panel or look for version.php fileVerify Fix Applied:
Test if arbitrary file write via admin_notify.php is no longer possible after patching📡 Detection & Monitoring
Log Indicators:
- Unusual file writes in web directories
- Multiple failed/successful admin login attempts
- POST requests to admin_notify.php with file parameters
Network Indicators:
- HTTP requests to admin_notify.php with file upload parameters
- Unusual outbound connections from web server
SIEM Query:
source="web_server" AND (uri="/admin_notify.php" OR file_write_event)