| शीर्षक | SeaCMS 13.3 SQL Injection |
|---|
| विवरण | Multiple SQL injection vulnerabilities exist in the SeaCMS backend video management module. The vulnerable code uses `implode()` to concatenate array elements directly into SQL queries without proper sanitization.
**⚠️ CRITICAL: Unlike frontend vulnerabilities, the backend disables SQL security checks!**
**Vulnerability Characteristics:**
- **Authentication Required**: Backend administrator access needed
- **Multiple Injection Points**: Lines 260, 293, 318, 326
- **WAF Protection**: ❌ DISABLED in backend (`$dsql->safeCheck = false`)
- **Fully Exploitable**: ✅ YES - UNION and time-based blind injection confirmed
|
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/aTI1wPFLm7FG |
|---|
| उपयोगकर्ता | yu22x (UID 34832) |
|---|
| सबमिशन | 16/12/2025 02:24 AM (10 महीनों पहले) |
|---|
| संयम | 21/12/2025 09:31 AM (5 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 337708 [SeaCMS तक 13.3 admin_video.php e_id SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|