Description

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-03T16:18:26.470Z",
  "pubdate": "2026-09-03T16:18:26.470Z",
  "executiveSummary": "A critical security vulnerability has been identified in the SeaCMS content management system, affecting versions up to and including 13.6. This vulnerability is classified as a remote code injection flaw and resides within the Locoy Collector component, specifically in the 'parseIf' function of the 'seacms_locoy_news.php' script. The vulnerability arises from insufficient sanitization of the 'pwd' parameter, which allows an attacker to inject and execute arbitrary PHP code. Because the exploit has been publicly disclosed and the attack can be initiated remotely without prior authentication, the risk level is extremely high. Successful exploitation grants attackers the ability to execute system commands, access sensitive databases, modify website content, or deploy persistent backdoors. Organizations running the affected versions of SeaCMS are urged to take immediate remediation steps to secure their environments against unauthorized access and potential full system compromise.\nThis vulnerability represents a significant threat to web application integrity, as it bypasses traditional perimeter controls by exploiting legitimate application entry points. The underlying mechanism relies on the server-side interpretation of user-supplied data as executable code, which completely undermines the security boundary between user input and system execution. Consequently, any internet-facing deployment of the vulnerable SeaCMS versions is highly susceptible to automated scanning and exploitation tools.",
  "technicalDetails": "The technical root cause of this vulnerability lies in the input processing architecture of the Locoy Collector component within SeaCMS. Specifically, the file 'seacms_locoy_news.php' accepts external inputs via HTTP requests. One such parameter is the 'pwd' argument, which is intended to handle authentication or configuration data for the Locoy import process. However, the application fails to validate, filter, or sanitize this input before passing it to the internal 'parseIf' function.\nThe 'parseIf' function is designed to handle conditional logic or template parsing within the CMS. In vulnerable versions, this function processes the input parameter dynamically using unsafe execution methods, such as PHP's eval() statement or similar template parsing mechanisms that execute inline PHP blocks. When user-supplied data in 'pwd' contains executable PHP code syntax, the parser interprets this data as code rather than a literal string, executing it in the context of the active PHP process.\nThe attack flow proceeds as follows: 1. The remote attacker identifies an active SeaCMS installation running version 13.6 or lower. 2. The attacker constructs a HTTP POST or GET request directed at the 'seacms_locoy_news.php' endpoint. 3. Within this request, the attacker populates the 'pwd' parameter with a malicious payload designed to trigger code execution (for example, utilizing PHP system execution functions or file writing functions). 4. The server receives the request and routes it to the Locoy Collector component. 5. The script extracts the 'pwd' value and passes it to 'parseIf'. 6. The 'parseIf' function evaluates the injected script, triggering immediate payload execution.\nNo privileges or prior authentication are required to trigger this vulnerability, making it highly exploitable. The network exposure is public, as the endpoint must be accessible for the collector to function. The post-exploitation impact of this vulnerability is severe: an attacker can read, write, or delete arbitrary files on the server, access backend databases via local configuration files, or establish a reverse shell to gain persistent interactive command-line access to the underlying operating system. This could lead to lateral movement within the network hosting the affected server.\nFurthermore, because the execution context inherits the permissions of the web server user (such as www-data or apache), the attacker's capabilities are initially bounded by these service account privileges. However, on misconfigured systems or systems with local privilege escalation vulnerabilities, this initial access can easily be leveraged to gain root or administrative control over the entire server infrastructure. This emphasizes the critical nature of restricting external input in legacy components."
}