CVE-2023-44171
📋 TL;DR
SeaCMS V12.9 contains an arbitrary file write vulnerability in admin_smtp.php that allows attackers to write malicious files to the server. This affects all SeaCMS V12.9 installations with the vulnerable component accessible. Attackers can potentially achieve remote code execution or system compromise.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution leading to data theft, ransomware deployment, or complete server takeover
Likely Case
Webshell deployment allowing persistent backdoor access, data exfiltration, and lateral movement within the network
If Mitigated
Limited impact if proper file permissions and access controls prevent execution of written files
🎯 Exploit Status
Exploitation requires admin access or authentication bypass to reach vulnerable component
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check for official SeaCMS updates
2. If patch available, backup current installation
3. Apply patch following vendor instructions
4. Verify admin_smtp.php is no longer vulnerable
🔧 Temporary Workarounds
Restrict admin_smtp.php access
linuxBlock or restrict access to the vulnerable admin_smtp.php file
chmod 000 admin_smtp.php
mv admin_smtp.php admin_smtp.php.disabled
Implement WAF rules
allAdd web application firewall rules to block suspicious file write attempts
🧯 If You Can't Patch
- Isolate SeaCMS instance from critical systems and databases
- Implement strict file system permissions and disable PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Check if SeaCMS version is V12.9 and admin_smtp.php exists in admin directoryCheck Version:
Check SeaCMS configuration files or admin panel for version informationVerify Fix Applied:
Test if arbitrary file write through admin_smtp.php is no longer possible📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in web server logs
- Multiple POST requests to admin_smtp.php
- Suspicious file creations in web directories
Network Indicators:
- HTTP requests to admin_smtp.php with file write parameters
- Unusual outbound connections from web server
SIEM Query:
source="web_server" AND (uri="*/admin_smtp.php" OR file_write_operation="suspicious")