Отправить #892781: SeaCMS 13.6 SQL Injection

SeaCMS version 13.6 suffers an unauthenticated SQL injection vulnerability within the zyapi.php file, triggered via the ids request parameter.
The application processes user-controlled input from the ids parameter and directly splices it into an SQL IN(...) conditional clause. The only input sanitization applied to ids is the native PHP addslashes() function, which merely escapes single quotes ('), double quotes ("), backslashes (\) and NULL bytes. No strict type casting, integer whitelisting, comma splitting validation, or regular expression filtering is implemented to restrict ids to a clean list of pure numeric IDs.
The program does not parse and validate the input as a strict comma-separated integer list: it fails to split the ids value by commas, iterate each segment, cast every segment to an integer, and reconstruct a safe numeric ID set for the SQL query. Since numeric SQL injection payloads contain no quotation marks, the addslashes() protection mechanism is completely bypassed and ineffective against this attack vector.
An unauthenticated remote attacker can craft malicious requests with arbitrary numeric SQL expressions inside the ids parameter to inject conditional logic, boolean blind SQL payloads, arithmetic operations, subqueries and comparison statements into the backend SQL statement. By manipulating the injected SQL logic, the attacker can fully alter the dataset returned by the database query, bypass access control filters, enumerate sensitive database tables, extract confidential user information, media resource data, administrator credentials, and perform further database reconnaissance.
This vulnerability requires no user authentication, no backend login privileges, and can be exploited via simple GET or POST HTTP requests targeting zyapi.php. There is no IP access restriction or request rate limiting to block exploitation attempts. Successful exploitation allows full blind SQL enumeration against the underlying MySQL database powering SeaCMS 13.6. No official patch or mitigation configuration is provided by the vendor for this flaw at the time of submission.

• Источник: ⚠️ https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-004-zyapi-ids-sql-injection.md
• Пользователь: flower (UID 93877)
• Представление: 16.07.2026 09:20 (2 месяцы назад)
• Модерация: 30.08.2026 08:42 (1 month later)
• Статус: принято
• Запись VulDB: 397102 [SeaCMS до 13.6 /zyapi.php?ac=videolist ids SQL-инъекция]
• Баллы: 20