Executive brief
SeaCMS includes an optional article collector module with a hardcoded default password (123456). An unauthenticated attacker who knows this password can inject malicious template code into articles, which is later executed as PHP code when articles are rendered on the front end. This allows remote code execution on the web server.
Technical details
This vulnerability combines a hardcoded default credential (CWE-798) with server-side template injection (CWE-94) and code injection. The seacms_locoy_news.php file in the optional Locoy Collector module checks for a hardcoded password ('123456') via the 'pwd' parameter but does not validate or strip executable template syntax from injected content. Article content containing {if:...} template directives is later evaluated by the parseIf() function using PHP eval(), allowing arbitrary code execution. The attack requires network access and knowledge of the default password, but no prior authentication or user interaction. The vulnerability is exploitable when the optional module is deployed to the admin directory as documented.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-09-03: disclosed
- exploited: Proof of concept exploit disclosed publicly