| शीर्षक | SeaCMS 13.6 Code Injection |
|---|
| विवरण | SeaCMS 13.6 includes optional Locoy collector interfaces intended to be copied into the admin directory. The article collector uses the default password 123456. If deployed and unchanged, an unauthenticated attacker who knows the default password can insert article content containing {if:...} template syntax. The article page later passes the content to parseIf(), which evaluates conditions with PHP eval(), resulting in code execution. |
|---|
| स्रोत | ⚠️ https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-001-locoy-default-password-template-rce.md |
|---|
| उपयोगकर्ता | T-Chachamaru (UID 99844) |
|---|
| सबमिशन | 16/07/2026 09:31 AM (3 महीनों पहले) |
|---|
| संयम | 03/09/2026 11:11 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 398364 [SeaCMS तक 13.6 Locoy Collector seacms_locoy_news.php parseIf pwd अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|