Executive brief
SeaCMS is a content management system with an optional WeChat messaging module. The module fails to verify WeChat message signatures and incorrectly processes XML input, allowing unauthenticated attackers to inject SQL commands through specially crafted XML messages. This can lead to unauthorized data disclosure from the application's database.
Technical details
SeaCMS 13.6's WeChat module (weixin/index.php) contains a SQL injection vulnerability arising from unsafe XML parsing combined with unvalidated SQL concatenation. The vulnerability exists because: (1) signature verification is only performed for the echostr endpoint parameter, allowing unauthenticated XML POST requests to reach message processing; (2) the code applies addslashes() to raw XML input and then parses it with simplexml_load_string(), which decodes XML entities such as ' back to single quotes, circumventing the escaping; (3) parsed values are directly concatenated into LIKE SQL queries without parameterization. An unauthenticated remote attacker can send crafted XML with encoded SQL injection payloads (e.g., ' OR '1' LIKE '1) in the Content field to exfiltrate data. The vulnerability is exploitable only when the WeChat module is explicitly enabled (disabled by default in SeaCMS 13.6). Public exploits are available.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-09-03: disclosed
- exploited: public exploit available