CVE-2025-44071
📋 TL;DR
SeaCMS v13.3 contains a remote code execution vulnerability in phomebak.php that allows attackers to execute arbitrary code via crafted HTTP requests. This affects all SeaCMS v13.3 installations with the vulnerable component accessible. Attackers can compromise the entire web server and underlying system.
💻 Affected Systems
- SeaCMS
📦 What is this software?
Seacms by Seacms
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing data theft, malware deployment, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Webshell deployment leading to website defacement, data exfiltration, cryptocurrency mining, or ransomware deployment.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and file integrity monitoring are in place.
🎯 Exploit Status
Public exploit code available on GitHub. Simple HTTP POST request with crafted parameters can trigger RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Check for official SeaCMS patch or update
2. If no patch, upgrade to latest SeaCMS version
3. Remove or restrict access to phomebak.php
4. Apply workarounds immediately
🔧 Temporary Workarounds
Delete vulnerable file
linuxRemove phomebak.php from the SeaCMS installation directory
rm /path/to/seacms/phomebak.php
Restrict file access
allBlock access to phomebak.php via web server configuration
<Location "/phomebak.php">
Order deny,allow
Deny from all
</Location>
🧯 If You Can't Patch
- Implement strict WAF rules blocking requests to phomebak.php
- Deploy network segmentation to isolate SeaCMS server from critical assets
🔍 How to Verify
Check if Vulnerable:
Check if phomebak.php exists in SeaCMS installation directory and is accessible via HTTPCheck Version:
Check SeaCMS version in admin panel or readme filesVerify Fix Applied:
Verify phomebak.php is deleted or returns 403/404 when accessed📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to phomebak.php with suspicious parameters
- Unusual process execution from web server user
- File creation in web directories with .php extensions
Network Indicators:
- Outbound connections from web server to suspicious IPs
- Unusual traffic patterns from SeaCMS server
SIEM Query:
source="web_logs" AND uri="/phomebak.php" AND method="POST"