CVE-2024-44921
📋 TL;DR
SeaCMS v12.9 contains a SQL injection vulnerability in the id parameter at /dmplayer/dmku/index.php?ac=del. This allows attackers to execute arbitrary SQL commands on the database. All SeaCMS v12.9 installations with the vulnerable component accessible are affected.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or remote code execution via database functions.
Likely Case
Database information disclosure, authentication bypass, or privilege escalation.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
SQL injection via GET parameter is straightforward to exploit with common tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the id parameter before processing.
Modify /dmplayer/dmku/index.php to validate id parameter as integer: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the vulnerable endpoint.
WAF rule: deny requests to /dmplayer/dmku/index.php?ac=del with SQL injection patterns in id parameter
🧯 If You Can't Patch
- Restrict access to /dmplayer/dmku/index.php via network ACLs or authentication.
- Implement database user with minimal privileges for the application.
🔍 How to Verify
Check if Vulnerable:
Test with sqlmap: sqlmap -u "http://target/dmplayer/dmku/index.php?ac=del&id=1" --batchCheck Version:
Check SeaCMS version in admin panel or readme files.Verify Fix Applied:
Re-run sqlmap test after implementing fixes to confirm SQL injection is blocked.📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /dmplayer/dmku/index.php?ac=del with unusual id parameter values
- SQL error messages in web server logs
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in id parameter
SIEM Query:
source="web_logs" AND uri="/dmplayer/dmku/index.php" AND query_string="*ac=del*" AND (query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*OR*1=1*")