CVE-2025-10662
📋 TL;DR
This SQL injection vulnerability in SeaCMS allows attackers to manipulate database queries through the /admin_members.php endpoint. Attackers can potentially read, modify, or delete database content. All SeaCMS installations up to version 13.3 are affected.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including admin credential theft, data exfiltration, or system takeover via subsequent attacks.
Likely Case
Unauthorized data access, privilege escalation, or data manipulation in the CMS database.
If Mitigated
Limited impact due to proper input validation, WAF rules, or database permissions restricting damage.
🎯 Exploit Status
Exploit requires admin authentication; public proof-of-concept available on GitHub
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.4 or later
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Upgrade SeaCMS to version 13.4 or later. 2. Apply vendor-provided patches if available. 3. Verify the /admin_members.php file has proper input validation.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation for ID parameter in admin_members.php
Modify /admin_members.php to validate ID parameter using is_numeric() or prepared statements
WAF Rule
allBlock SQL injection patterns targeting admin_members.php
Add WAF rule: deny requests to /admin_members.php?ac=editsave with suspicious SQL patterns
🧯 If You Can't Patch
- Restrict access to /admin_members.php endpoint using firewall rules
- Implement database-level permissions to limit damage from SQL injection
🔍 How to Verify
Check if Vulnerable:
Check SeaCMS version in admin panel or via version fileCheck Version:
Check admin panel or view source for version informationVerify Fix Applied:
Test /admin_members.php?ac=editsave endpoint with SQL injection payloads after patching📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by admin_members.php access
Network Indicators:
- HTTP requests to /admin_members.php?ac=editsave with SQL syntax in parameters
SIEM Query:
source="web_logs" AND uri="/admin_members.php" AND query="ac=editsave" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "OR 1=1")