CVE-2024-7161
📋 TL;DR
This CSRF vulnerability in SeaCMS 13.0 allows attackers to trick authenticated users into changing their passwords without their consent by manipulating the password change form. Attackers can launch this attack remotely when users visit malicious pages while logged into SeaCMS. All SeaCMS 13.0 installations with the vulnerable member.php component are affected.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could lock legitimate users out of their accounts by changing their passwords, potentially leading to account takeover if combined with other vulnerabilities or social engineering.
Likely Case
Users are tricked into changing their passwords to attacker-controlled values, resulting in temporary account lockout and potential credential theft.
If Mitigated
With proper CSRF protections, the attack fails as the server rejects unauthorized password change requests.
🎯 Exploit Status
Exploit requires user interaction (visiting malicious page while authenticated).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Check GitHub repository for updates or apply workarounds.
🔧 Temporary Workarounds
Add CSRF Token Protection
allImplement CSRF tokens in the password change form to validate legitimate requests.
Edit /member.php to add CSRF token generation and validation around the chgpwdsubmit action
Disable Password Change Function
allTemporarily disable the vulnerable password change functionality.
Comment out or remove the chgpwdsubmit action handler in /member.php
🧯 If You Can't Patch
- Implement WAF rules to block CSRF attacks targeting /member.php?action=chgpwdsubmit
- Educate users about CSRF risks and advise them to log out when not actively using SeaCMS
🔍 How to Verify
Check if Vulnerable:
Check if /member.php exists and contains the chgpwdsubmit action without CSRF token validation.Check Version:
Check SeaCMS version in admin panel or configuration files.Verify Fix Applied:
Test password change functionality with and without valid CSRF tokens to ensure unauthorized requests are rejected.📡 Detection & Monitoring
Log Indicators:
- Multiple failed password change attempts from same IP
- Password changes without corresponding login events
Network Indicators:
- HTTP POST requests to /member.php?action=chgpwdsubmit without Referer headers or with external Referers
SIEM Query:
source="web.log" AND uri="/member.php" AND action="chgpwdsubmit" AND NOT referer CONTAINS "yourdomain.com"