{"id":"CVE-2019-25778","kind":"vulnerability","aliases":["CVE-2019-25778"],"related":[],"title":"SeaCMS: unauthenticated SQL injection leaks database contents via error messages","description":"SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","summary":"SeaCMS through 8.7 lets anyone with network access inject SQL via the rlist[] array parameter of /comment/api/index.php, with no login. The extractvalue error-based technique dumps data such as the sea_admin name and password hash. Exploitation was observed by Shadowserver (first 2023-10-14), and public PoC payloads have existed since 2019. No vendor-fixed version is published.","severity":"high","cvss":8.8,"epss":0.00377,"exploited":true,"exploited_at":null,"products":[{"name":"SeaCMS","fixed":[],"affected":"<= 8.7","ecosystem":"php"}],"ecosystems":["php"],"tags":["package","php","seacms","self-hosted","sql-injection"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Look for comment/api/index.php in the web root. Search web logs for requests to /comment/api/index.php containing rlist[] with extractvalue, updatexml or backticks. Check the SeaCMS version in the admin panel or release files; <= 8.7 is affected. Safe test: GET /comment/api/index.php?gid=1&page=2&rlist[]=1 and look for a SQL error in the response. Also check data/mysqli_error_trace.php, which Chinese write-ups say can be abused.","fix":"No fixed release confirmed. Interim: block or remove /comment/api/index.php at the web server or WAF (deny any rlist[] parameter), disable the comment feature, and keep database errors out of responses. Rotate admin passwords if exposed. Consider migrating off SeaCMS.","status":"open","published_at":"2026-10-22T11:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:33+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T22:32:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SeaCMS: unauthenticated SQL injection leaks database contents via error messages","impact":"high","summary":"SeaCMS through 8.7 lets a remote attacker inject SQL through the rlist[] parameter with no login needed. Attackers use extractvalue error messages to pull database information out of the site.","category":"package","who_cares":["seacms","php","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"database contents readable by unauthenticated remote attackers","analyst_note":"Sources do not name a patched SeaCMS version or a file-level workaround; check the vendor site or the Shadowserver notice for a fixed release and whether /comment/api/index.php is exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000467,"input_tokens":2981,"output_tokens":337,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not name a patched SeaCMS version or a file-level workaround; check the vendor site or the Shadowserver notice for a fixed release and whether /comment/api/index.php is exposed.","search":"'-10':71B,149C '-14':72B,150C '-2019':12A,15A '-25778':13A,16A '/comment/api/index.php':43B,119C '2019':80B '2023':70B,148C '8.7':29B,90C 'access':34B 'admin':59B 'allow':98C 'anyon':31B 'array':40B,111C 'attack':100C,113C 'backtick':126C 'backtick-quot':125C 'base':51B 'contain':91C 'content':7A 'craft':121C 'cve':11A,14A 'data':54B 'databas':6A,103C,133C 'dump':53B 'error':9A,50B,136C 'error-bas':49B 'evid':139C 'exist':78B 'exploit':64B,138C 'extract':132C 'extractvalu':48B,130C 'first':69B,141C 'fix':84B 'foundat':146C 'get':116C 'hash':63B 'host':23B 'inform':134C 'inject':4A,26B,35B,95C,106C 'leak':5A 'let':30B 'login':46B 'manipul':102C 'messag':10A,137C 'name':60B 'network':33B 'observ':66B,142C 'packag':18B 'paramet':41B,112C 'password':62B 'payload':76B 'php':19B 'poc':75B 'public':74B 'publish':87B 'queri':104C 'quot':127C 'remot':99C 'request':117C 'rlist':39B,110C,122C 'sea':58B 'seacm':1A,20B,27B,88C 'seacms':17A 'self':22B 'self-host':21B 'send':115C 'shadowserv':68B,145C 'sinc':79B 'sql':3A,25B,36B,94C,107C 'sql-inject':24B 'techniqu':52B 'unauthent':2A,93C 'use':124C 'valu':123C 'variabl':128C 'vendor':83B 'vendor-fix':82B 'version':85B 'via':8A,37B,135C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2019-25778","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25778","severity":null,"published_at":"2026-10-22T11:17:03+00:00","modified_at":"2026-10-23T22:16:51+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2019-25778:506","url":null,"severity":null,"published_at":"2026-10-23T23:44:14+00:00","modified_at":"2026-10-23T23:44:17+00:00","first_seen_at":"2026-10-23T23:44:14+00:00","fetched_at":"2026-10-23T23:44:17+00:00","note":"Correction: removed the not-affected-if auth-required tag I set by mistake. The bug is unauthenticated, so no not-affected-if condition applies."},{"source":"epss","external_id":"CVE-2019-25778","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-25778","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":2139,"url":"https://www.vulncheck.com/advisories/seacms-8.7-sql-injection-via-comment-api-index-php-rlist-parameter","title":"VulnCheck: SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2140,"url":"https://www.cnblogs.com/ichunqiu/p/10644193.html","title":"Seacms 8.7 SQL injection analysis with extractvalue payload (2019)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2141,"url":"https://vuldb.com/vuln/425258","title":"VulDB 425258: SeaCMS up to 8.7 rlist[] sql injection","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}