CVE-2025-15002
📋 TL;DR
This SQL injection vulnerability in SeaCMS allows remote attackers to execute arbitrary SQL commands through manipulated page/limit parameters in the dmplayer component. It affects all SeaCMS installations up to version 13.3. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized database access allowing data extraction, privilege escalation, or installation of backdoors.
If Mitigated
Limited impact with proper input validation, WAF rules, and database permissions restricting damage scope.
🎯 Exploit Status
Public exploit disclosure increases likelihood of weaponization. SQL injection typically has low exploitation complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
1. Monitor SeaCMS vendor for official patch. 2. If patch becomes available, apply immediately. 3. Test in staging environment before production deployment.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation for page and limit parameters in mysqli.class.php
Edit js/player/dmplayer/dmku/class/mysqli.class.php to validate numeric inputs for page/limit parameters
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL injection patterns in page/limit parameters
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for all user inputs
- Restrict database user permissions to minimum required access level
🔍 How to Verify
Check if Vulnerable:
Check SeaCMS version. If version ≤ 13.3 and dmplayer component is present, assume vulnerable.Check Version:
Check SeaCMS admin panel or version.php file for version informationVerify Fix Applied:
Test with SQL injection payloads against page/limit parameters to confirm they are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with SQL-like patterns in page/limit parameters
- Error logs showing SQL syntax errors
Network Indicators:
- HTTP requests containing SQL keywords in page or limit parameters
- Unusual traffic patterns to dmplayer component
SIEM Query:
source="web_logs" AND (page="*UNION*" OR limit="*SELECT*" OR page="*OR*" OR limit="*AND*")