| शीर्षक | SeaCMS V13.3 SQL Injection |
|---|
| विवरण | A SQL injection vulnerability exists in SeaCMS v13.3.
The vulnerable parameter is `id` in `/admin_members.php?ac=editsave`.
An attacker can exploit this issue using a time-based blind SQL injection payload such as:
id=123 OR (SELECT 4554 FROM (SELECT(SLEEP(5)))tNAW)
Successful exploitation allows attackers to extract sensitive information from the database,
including usernames, password hashes, and configuration data.
The vulnerability has been confirmed using sqlmap with the following command:
sqlmap -r sql.txt -p id --dbms=mysql --level=5 --risk=3 --batch --random-agent
Test environment:
- Ubuntu 22
- Apache 2.4.62
- PHP 5.6.40
- MySQL 5.7.43
- SeaCMS v13.3 |
|---|
| स्रोत | ⚠️ https://github.com/coolcj-stack/seacms-v13.3-sqli/blob/main/README.md |
|---|
| उपयोगकर्ता | BlackSpdier (UID 89912) |
|---|
| सबमिशन | 07/09/2025 04:05 PM (1 वर्ष पहले) |
|---|
| संयम | 18/09/2025 07:13 AM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 324783 [SeaCMS तक 13.3 admin_members.php?ac=editsave पहचान SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|