Listen to this Post
How CVE-2025-3792 Works
This vulnerability in SeaCMS up to version 13.3 allows remote attackers to execute arbitrary SQL commands via the `e_id` parameter in /admin_link.php?action=delall. The flaw occurs due to improper sanitization of user-supplied input before being used in SQL queries. Attackers can craft malicious requests containing SQL injection payloads through this parameter, potentially leading to unauthorized database access, data manipulation, or complete system compromise. The vulnerability requires attacker to have admin privileges (PR:H in CVSS) but can be exploited remotely without user interaction.
DailyCVE Form
Platform: SeaCMS
Version: <=13.3
Vulnerability: SQL Injection
Severity: Critical
Date: 2025-07-15
Prediction: Patch by 2025-08-30
What Undercode Say
SELECT FROM seacms_links WHERE id IN (malicious_payload);
$e_id = $_GET['e_id']; // Unsanitized input $sql = "DELETE FROM ".DB_PREFIX."link WHERE e_id IN ($e_id)";
How Exploit
1. Craft SQLi payload for e_id parameter
2. Send GET request to /admin_link.php
3. Bypass authentication via session hijacking
4. Execute arbitrary database commands
Protection from this CVE
1. Input validation
2. Parameterized queries
3. Update to patched version
Impact
1. Data leakage
2. Admin takeover
3. RCE possible
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
