Executive brief
SeaCMS is a video content management system used to organize and deliver video libraries. A SQL injection vulnerability in the video API endpoint allows remote attackers to manipulate database queries through the ids parameter, potentially exposing sensitive video metadata and enabling unauthorized data access.
Technical details
SeaCMS 13.6 contains a SQL injection vulnerability in zyapi.php where the ids parameter is passed to an SQL IN clause after only addslashes() sanitization, without strict integer validation. The vulnerability exists because the parameter is interpreted as a SQL numeric expression rather than a validated comma-separated integer list, allowing attackers to inject arithmetic and SQL expressions (e.g., ids=2+1). No authentication or user interaction is required; the attack is remotely exploitable via HTTP GET request. An attacker can manipulate database queries to extract sensitive information, though UNION-based payloads and direct data exfiltration are restricted by the IN clause context. Remediation requires strict integer validation with intval() casting and parameterized queries rather than string concatenation.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-08-31: disclosed