| शीर्षक | SeaCMS 13.3 SQL Injection |
|---|
| विवरण | SQL Injection Leading to Remote Code Execution: A critical SQL injection vulnerability exists in the SeaCMS danmaku (bullet screen) system module. The vulnerable code is located in the 显示_弹幕列表() function within mysqli.class.php.
The 'page' and 'limit' parameters from user input ($_GET) are directly concatenated into the SQL query without any sanitization or proper parameterization. Although the application uses prepare() statement, the SQL string is constructed before the prepare call, making it completely ineffective against SQL injection attacks.
|
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/VFwALb6qhnTZ |
|---|
| उपयोगकर्ता | yu22x (UID 34832) |
|---|
| सबमिशन | 16/12/2025 02:23 AM (10 महीनों पहले) |
|---|
| संयम | 21/12/2025 09:31 AM (5 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 337707 [SeaCMS तक 13.3 mysqli.class.php page/limit SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|