Executive brief
SeaCMS is a content management system used to manage website content and media. An authenticated administrator can inject malicious PHP code through the configuration settings interface, allowing arbitrary code execution on the web server with the privileges of the web server process.
Technical details
This is a code injection vulnerability (CWE-94) in the admin_config.php configuration save endpoint. The application iterates over POST parameters prefixed with "edit___", strips the prefix, and uses the remaining parameter name to construct PHP variable assignments written to data/config.cache.inc.php. Because the parameter name itself is not validated against an allowlist and the output is written to an executable PHP file that is later included, an attacker can inject PHP syntax through a crafted parameter name (e.g., "edit___x;@system($_GET{0});//=poc"). Authentication as an administrator is required to reach the vulnerable endpoint. Upon successful exploitation, the attacker achieves remote code execution with web server process privileges. No vendor patch was confirmed at the time of publication.
Affected products
- SeaCMS SeaCMS 13.6
Timeline
- 2026-09-04: disclosed