High · published December 22, 2025
⚠️ A sneaky SQL injection is lurking in SeaCMS up to version 13.3! An attacker can exploit a crafty argument in the `mysqli.class.php` file to remotely manipulate your database. 🔥 Think of this vulnerability like a delivery driver who can peek inside your warehouse by following misleading instructions—they can access all sorts of secret files if they just know the right tricks! If an attacker successfully exploits this vulnerability, they could gain unauthorized access to your database, potentially allowing them to read, modify, or delete crucial data. This could lead to data breaches or a complete takeover of your application, which would be absolutely devastating!
Think of this vulnerability like a delivery driver who can peek inside your warehouse by following misleading instructions—they can access all sorts of secret files if they just know the right tricks! This vulnerability stems from an SQL injection issue in the `js/player/dmplayer/dmku/class/mysqli.class.php` file, where the manipulation of the `page/limit` argument allows attackers to execute arbitrary SQL commands remotely.
If an attacker successfully exploits this vulnerability, they could gain unauthorized access to your database, potentially allowing them to read, modify, or delete crucial data. This could lead to data breaches or a complete takeover of your application, which would be absolutely devastating! To protect against this vulnerability, update SeaCMS to the latest version immediately. Additionally, ensure that all user inputs are properly sanitized and parameterized queries are used to prevent SQL injection attacks. Regularly audit your code for similar vulnerabilities to keep your data safe! You've got this! Follow these steps, and you'll have your SeaCMS fortified in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| seacms/seacms | ≥ 13.0, ≤ 13.3 | — |