{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/seacms--8.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:seacms:seacms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2019-25778"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SeaCMS (\u003c= 8.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SeaCMS"],"content_html":"\u003cp\u003eSeaCMS through version 8.7 contains an unauthenticated SQL injection vulnerability in the /comment/api/index.php endpoint. The flaw exists in the handling of the rlist[] array parameter, which allows an attacker to manipulate database queries. By injecting crafted values including backtick-quoted variables and the extractvalue function, attackers can force the application to return database content within error messages. Exploitation of this vulnerability has been observed in the wild since October 2023.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized extraction of database information through error-based techniques, potentially leading to full database compromise or information disclosure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and audit all deployments of SeaCMS in the environment to determine if versions 8.7 or older are in use.\u003c/li\u003e\n\u003cli\u003eUpgrade to the latest version of SeaCMS that remediates CVE-2019-25778.\u003c/li\u003e\n\u003cli\u003eImplement WAF rules to inspect HTTP GET requests to /comment/api/index.php and block or log requests containing SQL metacharacters or function calls (e.g., extractvalue, backticks) within the rlist[] parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T14:14:49Z","date_published":"2026-10-22T14:14:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-seacms-sqli/","summary":"SeaCMS versions through 8.7 are vulnerable to unauthenticated remote SQL injection via the rlist[] parameter, enabling database information exfiltration through error-based exploitation.","title":"SeaCMS: Unauthenticated SQL injection (CVE-2019-25778)","url":"https://feed.craftedsignal.io/briefs/2026-10-seacms-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - SeaCMS (\u003c= 8.7)","version":"https://jsonfeed.org/version/1.1"}