Live › vulnerability › CVE-2019-25778
Go to dashboardSeaCMS through 8.7 lets anyone with network access inject SQL via the rlist[] array parameter of /comment/api/index.php, with no login. The extractvalue error-based technique dumps data such as the sea_admin name and password hash. Exploitation was observed by Shadowserver (first 2023-10-14), and public PoC payloads have existed since 2019. No vendor-fixed version is published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SeaCMS | php | <= 8.7 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
This page as .md · .json · in your agent: get_signal("CVE-2019-25778")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.