CVE-2025-44071

Executive Summary

CVE-2025-44071 is a critical Remote Code Execution (RCE) vulnerability discovered in SeaCMS v13.3, specifically within the phomebak.php component. This flaw allows an unauthenticated attacker to execute arbitrary code on the target server by sending a crafted request. The vulnerability has been assigned a CVSS score of 0.0 in the initial NVD data, but based on the nature of the flaw (unauthenticated RCE), the actual severity is critical. No official patch or exploit code has been publicly released at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but this may change as details become more widely known.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the SeaCMS PHP application.

CVSS Breakdown & Threat Level

While the NVD has assigned a CVSS score of 0.0, this is likely a placeholder or error. Based on the vulnerability description (unauthenticated RCE), the following CVSS vector is estimated:

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The exploit does not affect other components.
• Confidentiality (C): High (H) - Full system compromise is possible.
• Integrity (I): High (H) - Arbitrary code execution allows modification of data.
• Availability (A): High (H) - An attacker can disrupt services.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Threat Level: Critical. This vulnerability allows for complete server takeover without authentication.

Deep Dive & Mechanics

The vulnerability resides in the phomebak.php file of SeaCMS v13.3. This file is typically used for database backup and restoration operations. The flaw is likely due to insufficient input validation or sanitization of user-supplied parameters, allowing an attacker to inject and execute arbitrary PHP code.

Potential Attack Vector:

1. The attacker sends a crafted HTTP request to the vulnerable phomebak.php endpoint.
2. The request contains malicious payloads in parameters such as filename, filepath, or other variables used in file operations or eval()/system() calls.
3. The application fails to properly sanitize the input, leading to the execution of the attacker's code on the server.

Common RCE Patterns in PHP:

• File Inclusion: Using include() or require() with user-controlled paths.
• Command Injection: Using system(), exec(), shell_exec(), or backticks with unsanitized input.
• Code Injection: Using eval() or assert() with user-controlled strings.
• File Upload: Uploading a malicious PHP file and then accessing it.

Given the function of phomebak.php (backup/restore), the vulnerability is most likely a file inclusion or command injection flaw, where the attacker can specify a malicious file path or command.

Vulnerable vs. Patched Code

Since no official patch is available, a direct code comparison cannot be made. However, based on common remediation patterns, the following is a hypothetical example of the vulnerable code and its patched version.

Vulnerable Code (Hypothetical phomebak.php):

<?php
$filename = $_GET['filename'];
include($filename); // Vulnerable to LFI/RFI
?>

Patched Code (Hypothetical):

<?php
$filename = basename($_GET['filename']); // Remove path traversal
$allowed_path = '/var/www/html/backups/';
$full_path = $allowed_path . $filename;
if (file_exists($full_path) && strpos(realpath($full_path), realpath($allowed_path)) === 0) {
    include($full_path);
} else {
    die('Invalid file.');
}
?>

The patched version uses basename() to strip directory traversal characters and validates that the file is within an allowed directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running SeaCMS v13.3.
• Network access to the phomebak.php endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target.com/phomebak.php
2. Craft a malicious request: The exact parameters depend on the specific vulnerability. A common approach is to use a file inclusion payload.

   # Example using curl for a potential LFI/RFI
   curl -X GET "http://target.com/phomebak.php?filename=../../../../etc/passwd"
   

3. Achieve RCE: If LFI is possible, use a PHP filter chain or log poisoning to execute code. If command injection is possible, inject commands directly.

   # Example command injection (hypothetical)
   curl -X GET "http://target.com/phomebak.php?cmd=id"
   

4. Establish Persistence: Upload a web shell or create a reverse shell.

Proof-of-Concept (Hypothetical):

import requests

target = "http://target.com/phomebak.php"
payload = "system('id');"
data = {"filename": f"php://input", "data": payload}
response = requests.post(target, data=data)
print(response.text)

Blue Team (Defense & Detection)

Detection Strategies:

• Monitor Web Logs: Look for unusual requests to phomebak.php with parameters like filename, filepath, cmd, or exec.
• File Integrity Monitoring: Monitor changes to critical system files and web directories.
• WAF Rules: Block requests to phomebak.php with suspicious parameters or payloads.

Hunting Queries:

• Search for HTTP requests containing phomebak.php with ../ (path traversal) or system/exec (command injection).
• Look for outbound connections from the web server to unknown IPs (potential reverse shell).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /phomebak.php with parameters like filename, filepath, cmd, exec, or data.
  • Requests containing base64-encoded payloads or PHP code.
  • Outbound connections to unusual IP addresses on ports 80, 443, or 4444 (common reverse shell ports).
• File System IOCs:
  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Modified or new files in /tmp/ or /var/tmp/.
  • Changes to /etc/passwd or /etc/shadow.
• Process IOCs:
  • Unusual processes running as the web server user (e.g., www-data).
  • Processes like nc, bash, python, or perl spawned by the web server.

Detection Engineering

YARA Rule

rule CVE_2025_44071_SeaCMS_RCE {
    meta:
        description = "Detects SeaCMS phomebak.php RCE attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44071"
    strings:
        $s1 = "phomebak.php" nocase
        $s2 = "filename=" nocase
        $s3 = "filepath=" nocase
        $s4 = "system(" nocase
        $s5 = "exec(" nocase
        $s6 = "passthru(" nocase
        $s7 = "shell_exec(" nocase
        $s8 = "eval(" nocase
        $s9 = "assert(" nocase
        $s10 = "base64_decode(" nocase
    condition:
        $s1 and ($s2 or $s3) and ($s4 or $s5 or $s6 or $s7 or $s8 or $s9 or $s10)
}

Sigma Rule

title: SeaCMS phomebak.php RCE Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2025-44071 in SeaCMS
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'phomebak.php'
            - 'filename='
            - 'filepath='
            - 'system('
            - 'exec('
            - 'passthru('
            - 'shell_exec('
            - 'eval('
            - 'assert('
            - 'base64_decode('
    condition: selection
falsepositives:
    - Legitimate backup operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-44071 SeaCMS phomebak.php RCE Attempt"; flow:to_server,established; content:"phomebak.php"; http_uri; content:"filename="; http_uri; pcre:"/(system|exec|passthru|shell_exec|eval|assert|base64_decode)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable component: If phomebak.php is not essential, remove or rename it immediately.
2. Restrict Access: Use .htaccess or firewall rules to restrict access to phomebak.php to trusted IP addresses only.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing suspicious patterns (path traversal, command injection).

Long-Term Fixes:

1. Apply Vendor Patch: Monitor the SeaCMS official website for a security patch. If none is available, consider migrating to a different CMS.
2. Code Hardening: If you have access to the source code, implement proper input validation and sanitization in phomebak.php.
3. Regular Updates: Keep all software up to date to mitigate future vulnerabilities.

Workaround:

• Implement a virtual patch using a WAF or reverse proxy to block requests to phomebak.php with suspicious parameters.

Valters IT
Securing Digital Frontiers