Description

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T02:17:02.603Z",
  "pubdate": "2026-08-31T02:17:02.603Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in SeaCMS versions up to 13.6. The flaw resides within the /zyapi.php file, specifically impacting the 'videolist' action triggered by the 'ac' parameter.\nThis vulnerability allows unauthenticated, remote attackers to manipulate the 'ids' argument, leading to unauthorized execution of arbitrary SQL queries against the underlying database.\nThe exploitation of this flaw can result in full database compromise, including the unauthorized retrieval, modification, or deletion of sensitive information, such as administrator credentials or user data.\nGiven that exploit code has been publicly disclosed and the vulnerability is remotely exploitable without authentication, the risk level is critical. Organizations utilizing affected versions of SeaCMS are advised to treat this as a high-priority security concern due to the ease of remote execution and the potential for complete system compromise.",
  "technicalDetails": "The vulnerability is an Improper Neutralization of Special Elements used in an SQL Command, classified as SQL Injection. The flaw is located in the file /zyapi.php within the SeaCMS content management system.\nThe root cause of the vulnerability is the improper sanitization and validation of the 'ids' input parameter processed by the 'videolist' action (ac=videolist). The application fails to adequately escape or parameterize user-supplied input before incorporating it into database queries, allowing an attacker to break out of the intended query structure.\nThe attack flow begins with a remote, unauthenticated attacker sending a crafted HTTP request to the /zyapi.php endpoint. By appending malicious SQL syntax to the 'ids' argument, the attacker can manipulate the query logic. For instance, an attacker could use UNION-based techniques to extract data from other tables or error-based injection to infer database schema information.\nBecause the 'ids' parameter is not subjected to strict type checking or input filtering, the backend database engine executes the injected SQL commands with the privileges assigned to the web application's database user. This effectively grants the attacker the ability to bypass application-level access controls.\nThe post-exploitation impact is severe. Since the application likely runs with elevated database permissions to perform its core functions, an attacker can perform bulk data exfiltration, modify account settings, or potentially pivot to administrative control over the CMS. In some environments, this may even lead to further exploitation, such as gaining OS-level access if the database configuration permits interaction with the filesystem.\nThis vulnerability affects all versions of SeaCMS up to and including 13.6. It is reachable over the network and does not require the attacker to have pre-existing credentials, making it a high-utility target for automated vulnerability scanners and malicious actors."
}