Executive brief
SeaCMS is a content management system for managing video content. A reflected cross-site scripting (XSS) vulnerability in the error reporting page allows remote attackers to inject malicious JavaScript that executes in users' browsers, potentially stealing session cookies, hijacking user accounts, or defacing the site. User interaction (clicking a crafted link) is required to trigger the attack.
Technical details
A reflected XSS vulnerability exists in SeaCMS 13.6's /err.php file where the errtxt GET parameter is echoed directly into an HTML textarea element without proper output encoding. The vulnerable code at line 122 outputs the parameter using echo without htmlspecialchars() escaping. An attacker can craft a malicious URL with payload such as </textarea><iframe src="javascript:..."> to break out of the textarea context and inject executable HTML/JavaScript. The attack requires user interaction (victim must visit the crafted link) but no authentication. While the default web application firewall blocks simple <script> tags, it does not prevent all executable HTML contexts like iframe with javascript: protocol handlers.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-08-31: disclosed
- other: Exploit proof-of-concept publicly available