---
id: "CVE-2019-25778"
kind: "vulnerability"
aliases: ["CVE-2019-25778"]
title: "SeaCMS: unauthenticated SQL injection leaks database contents via error messages"
severity: "high"
cvss: 8.8
epss: 0.00377
exploited: true
status: "open"
category: "package"
products: [{"name": "SeaCMS", "fixed": [], "affected": "<= 8.7", "ecosystem": "php"}]
ecosystems: ["php"]
tags: ["package", "php", "seacms", "self-hosted", "sql-injection"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-22T11:17:03+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25778", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:44:14+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-25778", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# SeaCMS: unauthenticated SQL injection leaks database contents via error messages

SeaCMS through 8.7 lets anyone with network access inject SQL via the rlist[] array parameter of /comment/api/index.php, with no login. The extractvalue error-based technique dumps data such as the sea_admin name and password hash. Exploitation was observed by Shadowserver (first 2023-10-14), and public PoC payloads have existed since 2019. No vendor-fixed version is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- php:SeaCMS affected <= 8.7 fixed ?

## How to check

Look for comment/api/index.php in the web root. Search web logs for requests to /comment/api/index.php containing rlist[] with extractvalue, updatexml or backticks. Check the SeaCMS version in the admin panel or release files; <= 8.7 is affected. Safe test: GET /comment/api/index.php?gid=1&page=2&rlist[]=1 and look for a SQL error in the response. Also check data/mysqli_error_trace.php, which Chinese write-ups say can be abused.

## Fix

No fixed release confirmed. Interim: block or remove /comment/api/index.php at the web server or WAF (deny any rlist[] parameter), disable the comment feature, and keep database errors out of responses. Rotate admin passwords if exposed. Consider migrating off SeaCMS.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-25778
- 2026-10-23T23:44:14+00:00 analyst — Correction: removed the not-affected-if auth-required tag I set by mistake. The bug is unauthenticated, so no not-affected-if condition applies.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-25778

## Documents

- [advisory] VulnCheck: SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter https://www.vulncheck.com/advisories/seacms-8.7-sql-injection-via-comment-api-index-php-rlist-parameter
- [mentions] VulDB 425258: SeaCMS up to 8.7 rlist[] sql injection https://vuldb.com/vuln/425258
- [poc] Seacms 8.7 SQL injection analysis with extractvalue payload (2019) https://www.cnblogs.com/ichunqiu/p/10644193.html

## From the sources

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_