T-Chachamaru

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms locoy news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

**Name of the Vulnerable Software and Affected Versions** SeaCMS versions prior to 13.7 **Description** An issue exists in the WeChat Module within the file `weixin/index.php`. The `addslashes()` function fails to properly sanitize the `Content` argument, allowing a remote attacker to perform SQL injection. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update SeaCMS to a version later than 13.6. As a temporary mitigation, restrict access to the `weixin/index.php` file or avoid using the `Content` argument in the WeChat Module.

**Name of the Vulnerable Software and Affected Versions** SeaCMS versions prior to 13.7 **Description** A weakness in the `/err.php` file allows for remote cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. This occurs through the manipulation of the `errtxt` variable. **Recommendations** Update SeaCMS to a version later than 13.6. As a temporary workaround, restrict access to the `/err.php` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SeaCMS versions prior to 13.7 **Description** Remote code injection is possible within the Template Engine component due to improper handling of the `searchtype` argument in the `parseIf()` function of the `search.php` file. **Recommendations** Update SeaCMS to version 13.7 or later. As a temporary mitigation, restrict access to the `search.php` file or avoid using the `searchtype` parameter.

**Name of the Vulnerable Software and Affected Versions** SeaCMS versions prior to 13.7 **Description** A path traversal issue exists in the Comment Cache component. This occurs due to improper processing of the `/member.php?action=del pl` endpoint when handling the `itype` and `vid` variables. A remote attacker can manipulate these variables to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Update SeaCMS to version 13.7 or later. Restrict access to the `/member.php?action=del pl` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SeaCMS versions prior to 13.7 **Description** An authorization bypass exists in the `/ass.php` endpoint. This issue allows a remote attacker to bypass security checks through the manipulation of unknown code within that file. **Recommendations** Update SeaCMS to a version later than 13.6. As a temporary workaround, restrict access to the `/ass.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SeaCMS versions prior to 13.7 **Description** A path traversal issue exists in the Avatar Upload component within the `/member.php?action=chgpwdsubmit` endpoint. The vulnerability occurs in the `unlink()` function when processing the `oldpic` variable, allowing a remote attacker to manipulate file paths. **Recommendations** Update SeaCMS to a version later than 13.6. As a temporary mitigation, restrict access to the `/member.php?action=chgpwdsubmit` endpoint or avoid using the `oldpic` parameter.