SeaCMS (<= 8.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/seacms--8.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:14:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSeaCMS: Unauthenticated SQL injection (CVE-2019-25778)https://feed.craftedsignal.io/briefs/2026-10-seacms-sqli/Thu, 22 Oct 2026 14:14:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-seacms-sqli/SeaCMS versions through 8.7 are vulnerable to unauthenticated remote SQL injection via the rlist[] parameter, enabling database information exfiltration through error-based exploitation.SeaCMS through version 8.7 contains an unauthenticated SQL injection vulnerability in the /comment/api/index.php endpoint. The flaw exists in the handling of the rlist[] array parameter, which allows an attacker to manipulate database queries. By injecting crafted values including backtick-quoted variables and the extractvalue function, attackers can force the application to return database content within error messages. Exploitation of this vulnerability has been observed in the wild since October 2023.

Impact

Successful exploitation allows for the unauthorized extraction of database information through error-based techniques, potentially leading to full database compromise or information disclosure.

Recommendation

  • Identify and audit all deployments of SeaCMS in the environment to determine if versions 8.7 or older are in use.
  • Upgrade to the latest version of SeaCMS that remediates CVE-2019-25778.
  • Implement WAF rules to inspect HTTP GET requests to /comment/api/index.php and block or log requests containing SQL metacharacters or function calls (e.g., extractvalue, backticks) within the rlist[] parameter.
]]>highadvisory