CVE-2024-7161: Seacms 13.0 CSRF Vulnerability

CVE-2024-7161 Overview

CVE-2024-7161 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in SeaCMS 13.0. The flaw resides in the Password Change Handler exposed through /member.php?action=chgpwdsubmit. Attackers can manipulate the newpwd and newpwd2 parameters to change a victim's password without their consent. The vulnerability is exploitable remotely and requires no authentication on the attacker side, though it relies on tricking an authenticated SeaCMS user into visiting a malicious page. Public disclosure has occurred through VulDB entry VDB-272575 and a GitHub issue on the SeaCMS repository.

Critical Impact
Successful exploitation allows an unauthenticated remote attacker to hijack a victim's SeaCMS account by forcing a password change, leading to account takeover.

Affected Products

SeaCMS 13.0
Component: Password Change Handler (/member.php?action=chgpwdsubmit)
Vulnerable parameters: newpwd, newpwd2

Discovery Timeline

2024-07-28 - CVE-2024-7161 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7161

Vulnerability Analysis

SeaCMS 13.0 exposes a password change endpoint at /member.php?action=chgpwdsubmit that lacks anti-CSRF protections. The handler accepts the new password via the newpwd and newpwd2 parameters but does not validate that the request originated from a legitimate user-initiated form submission. No CSRF token, Origin header check, or Referer header enforcement is applied before the password update is committed.

An attacker who convinces an authenticated SeaCMS member to visit an attacker-controlled page can force the browser to submit the password change request using the victim's session cookies. The server processes the request as legitimate and updates the account credentials. The vulnerability has been assigned VulDB identifier VDB-272575, with a public discussion available on the SeaCMS GitHub issue tracker.

Root Cause

The root cause is missing CSRF countermeasures on a state-changing endpoint. Web application frameworks typically mitigate this class of issue with per-session or per-request synchronizer tokens, SameSite cookie attributes, or double-submit cookie patterns. None of these controls are enforced on the chgpwdsubmit action in SeaCMS 13.0.

Attack Vector

Exploitation follows the standard CSRF pattern. An attacker hosts a webpage containing a hidden HTML form or JavaScript-driven request that targets the vulnerable endpoint with attacker-chosen newpwd and newpwd2 values. When a currently authenticated SeaCMS member loads the malicious page, the browser attaches session cookies to the cross-origin POST request. The SeaCMS backend then updates the victim's password, granting the attacker persistent account access.

See the GitHub Issue Discussion and VulDB #272575 for technical details.

Detection Methods for CVE-2024-7161

Indicators of Compromise

Unexpected POST requests to /member.php?action=chgpwdsubmit where the Referer or Origin header points to an external, non-SeaCMS domain.
Password change events immediately following user navigation from external links or email campaigns.
Multiple user account lockouts or user-reported inability to log in after their last known session.

Detection Strategies

Enable verbose access logging on the SeaCMS web server and alert on chgpwdsubmit requests lacking a same-origin Referer header.
Correlate password change events with the originating HTTP referer and user-agent to identify anomalous sources.
Deploy a Web Application Firewall (WAF) rule that inspects requests to the password change endpoint and blocks those missing an expected CSRF token or valid same-origin header.

Monitoring Recommendations

Baseline the normal rate of password change requests per user and alert on sudden spikes.
Monitor authentication logs for logins from new IP addresses or geographies immediately following a password change.
Aggregate SeaCMS application logs into a centralized SIEM or data lake for cross-source correlation and retention.

How to Mitigate CVE-2024-7161

Immediate Actions Required

Restrict access to the SeaCMS /member.php endpoint at the network or WAF layer while a patch is pending.
Force a password reset for all SeaCMS members to invalidate any credentials that may have been changed by an attacker.
Review web server logs for prior exploitation attempts against chgpwdsubmit and investigate any anomalies.

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2024-7161 at the time of publication. Administrators should monitor the SeaCMS GitHub repository and the VulDB advisory for remediation guidance and updates.

Workarounds

Deploy a WAF rule that requires a matching same-origin Referer or Origin header on POST requests to /member.php?action=chgpwdsubmit.
Set the SeaCMS session cookie to SameSite=Strict (or at minimum SameSite=Lax) at the reverse proxy or application layer to block cross-site cookie transmission.
Educate SeaCMS users to log out after each session and avoid clicking untrusted links while authenticated to the CMS.

bash

# Example NGINX rule enforcing same-origin Referer on the vulnerable endpoint
location = /member.php {
    if ($request_method = POST) {
        if ($http_referer !~* "^https?://your-seacms-domain\.tld/") {
            return 403;
        }
    }
    proxy_pass http://seacms_backend;
}