CVE-2024-55461
📋 TL;DR
SeaCMS versions up to 13.0 contain a command injection vulnerability in phome.php through the Ebak_RepPathFiletext() function. This allows attackers to execute arbitrary commands on the server with the privileges of the web server process. All SeaCMS installations running vulnerable versions are affected.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, ransomware deployment, lateral movement to other systems, and complete system takeover.
Likely Case
Remote code execution allowing attackers to install backdoors, steal sensitive data, deface websites, or use the server for malicious activities.
If Mitigated
Limited impact if proper network segmentation, least privilege principles, and input validation are implemented, though command execution would still be possible.
🎯 Exploit Status
The vulnerability appears to be publicly documented with technical details available. Command injection vulnerabilities are typically easy to exploit once details are known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - check vendor for updates
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check for official SeaCMS updates beyond version 13.0. 2. If patch exists, backup your site. 3. Apply the update following SeaCMS documentation. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Disable or restrict phome.php access
allTemporarily block access to the vulnerable phome.php file while awaiting patch
# For Apache: Add to .htaccess
<Files "phome.php">
Order allow,deny
Deny from all
</Files>
# For Nginx: Add to server block
location ~ /phome\.php$ {
deny all;
return 403;
}
Input validation hardening
allAdd input validation to filter command injection attempts
# Add to phome.php before Ebak_RepPathFiletext() call
function sanitize_input($input) {
$dangerous = array(';', '|', '&', '`', '$', '(', ')', '{', '}', '[', ']', '>', '<', '\n', '\r');
return str_replace($dangerous, '', $input);
}
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block command injection patterns
- Restrict network access to SeaCMS administration interfaces and limit to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check if SeaCMS version is <= 13.0 and if phome.php exists and contains Ebak_RepPathFiletext() functionCheck Version:
# Check SeaCMS version
cat /path/to/seacms/version.txt || grep -r 'SeaCMS' /path/to/seacms/ | grep -i versionVerify Fix Applied:
Test the vulnerable endpoint with safe payloads (like 'echo test') to confirm command execution is no longer possible📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to phome.php with shell metacharacters
- Web server logs showing command execution patterns in URLs/parameters
- System logs showing web server process spawning unexpected child processes
Network Indicators:
- HTTP requests containing shell commands in parameters
- Outbound connections from web server to unexpected destinations
SIEM Query:
source="web_server_logs" AND (url="*phome.php*" AND (param="*;*" OR param="*|*" OR param="*`*" OR param="*$(*"))