Description

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-03T16:18:26.677Z",
  "pubdate": "2026-09-03T16:18:26.677Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in SeaCMS up to version 13.6 within the WeChat Module.\nThe vulnerability resides in the handling of the 'Content' argument in 'weixin/index.php', where improper sanitization via the 'addslashes' function fails to prevent malicious database query manipulation.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database.\nSuccessful exploitation results in unauthorized data access, potential modification or deletion of database contents, and could lead to complete compromise of the application's data layer.\nGiven that the exploit is publicly available, the risk to affected installations is high, necessitating immediate defensive measures to prevent exploitation.",
  "technicalDetails": "The vulnerability is classified as an SQL injection arising from insufficient input validation and sanitization within the WeChat Module of SeaCMS, specifically located in the 'weixin/index.php' file.\nThe root cause is the reliance on the 'addslashes' function to sanitize the 'Content' argument before it is incorporated into an SQL query. The 'addslashes' function is cryptographically and logically insufficient for preventing SQL injection, as it only escapes specific characters (such as single quotes, double quotes, and backslashes) but fails to account for diverse character encoding scenarios or context-specific SQL injection bypass techniques.\nAn attacker can exploit this by crafting a malicious payload within the 'Content' parameter. Because the application processes this input without robust parameterized queries or prepared statements, the injected SQL code is interpreted by the database engine as part of the intended command structure.\nThe attack flow proceeds as follows: An external attacker sends a specially crafted HTTP request targeting the 'weixin/index.php' endpoint. The attacker provides a payload in the 'Content' argument designed to break the existing SQL syntax (e.g., using UNION-based injection or boolean-based blind injection techniques). The application passes this string through the vulnerable 'addslashes' filter, which fails to neutralize the malicious syntax. The backend database then executes the concatenated query, allowing the attacker to retrieve data from arbitrary tables, circumvent authentication mechanisms, or potentially escalate privileges within the database environment.\nThe component affected is the WeChat Module of SeaCMS, with all versions up to and including 13.6 confirmed as vulnerable. Exploitation can be performed remotely over the network without requiring prior authentication, making the vulnerability particularly severe for exposed web servers.\nPost-exploitation impact includes full database disclosure, potential administrative account takeover, and persistent cross-site scripting (XSS) if the database stores payloads that are subsequently rendered in the victim's browser. Furthermore, depending on the database configuration and permissions, an attacker might leverage database features to interact with the underlying operating system."
}