SeaCMS: Unauthenticated SQL injection (CVE-2019-25778)
SeaCMS versions through 8.7 are vulnerable to unauthenticated remote SQL injection via the rlist[] parameter, enabling database information exfiltration through error-based exploitation.
CVE search metadata
CVE search record: CVE-2019-25778. Severity: high. CVSS: 8.2. KEV: no. Product: SeaCMS (<= 8.7). Brief: SeaCMS: Unauthenticated SQL injection (CVE-2019-25778). Brief link: https://feed.craftedsignal.io/briefs/2026-10-seacms-sqli/
Triage facts
Revision 1- Applicability
- SeaCMS (<= 8.7)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 14:14 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
SeaCMS through version 8.7 contains an unauthenticated SQL injection vulnerability in the /comment/api/index.php endpoint. The flaw exists in the handling of the rlist[] array parameter, which allows an attacker to manipulate database queries. By injecting crafted values including backtick-quoted variables and the extractvalue function, attackers can force the application to return database content within error messages. Exploitation of this vulnerability has been observed in the wild since October 2023.
Impact
Successful exploitation allows for the unauthorized extraction of database information through error-based techniques, potentially leading to full database compromise or information disclosure.
Recommendation
- Identify and audit all deployments of SeaCMS in the environment to determine if versions 8.7 or older are in use.
- Upgrade to the latest version of SeaCMS that remediates CVE-2019-25778.
- Implement WAF rules to inspect HTTP GET requests to /comment/api/index.php and block or log requests containing SQL metacharacters or function calls (e.g., extractvalue, backticks) within the rlist[] parameter.
Immediate actions
Patch SeaCMS deployments to a version above 8.7.
Threat Hunt
Inspect web logs for attempts to access /comment/api/index.php containing SQL injection patterns.
Data: Web server access logs
Detection coverage 1
Detect CVE-2019-25778 Exploitation - SQL Injection in SeaCMS
highDetects exploitation attempts against SeaCMS by identifying suspicious characters and SQL functions within the rlist parameter of the index.php comment API.
Detection queries are available on the platform. Get full rules →