Listen to this Post
How the CVE Works
The CVE-2025-3797 vulnerability in SeaCMS (up to v13.3) allows remote attackers to execute arbitrary SQL queries via the `e_id` parameter in /admin_topic.php?action=delall. This occurs due to insufficient input sanitization, enabling SQL injection when malicious payloads are crafted. Attackers can manipulate database operations, potentially leading to data theft, authentication bypass, or system compromise. The flaw is exploitable remotely without authentication but requires admin-level privileges (PR:H in CVSS 4.0).
DailyCVE Form
Platform: SeaCMS
Version: ≤13.3
Vulnerability: SQL Injection
Severity: Critical
Date: 2025-07-15
Prediction: Patch by 2025-08-30
What Undercode Say
SELECT FROM topics WHERE id IN (malicious_payload);
curl -X POST "http://target/admin_topic.php?action=delall&e_id=1' OR 1=1--"
How Exploit
1. Craft malicious `e_id` payload
2. Send HTTP request to `/admin_topic.php`
3. Execute arbitrary SQL commands
Protection from this CVE
1. Update SeaCMS
2. Input validation
3. Parameterized queries
Impact
1. Data leakage
2. RCE potential
3. System compromise
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
