CVE-2025-11071: SeaCMS SQL Injection Vulnerability

CVE-2025-11071 Overview

CVE-2025-11071 is a SQL injection vulnerability in SeaCMS version 13.3.20250820. The flaw resides in the /admin_cron.php file within the Cron Task Management Module. Attackers can manipulate the resourcefrom and collectID parameters to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely over the network, though it requires high privileges to abuse. Public disclosure of the exploit technique has occurred, increasing the risk of opportunistic exploitation against unpatched installations. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated attackers can manipulate SQL queries in the SeaCMS Cron Task Management Module to read, modify, or delete database content.

Affected Products

• SeaCMS 13.3.20250820
• Component: Cron Task Management Module (/admin_cron.php)
• Vendor: SeaCMS

Discovery Timeline

• 2025-09-27 - CVE-2025-11071 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11071

Vulnerability Analysis

The vulnerability exists in the administrative cron task handler at /admin_cron.php. The script accepts user-controlled input through the resourcefrom and collectID parameters without applying proper sanitization or parameterized query binding. As a result, attacker-supplied values are concatenated directly into SQL statements executed against the SeaCMS database backend.

Exploitation requires an authenticated administrative session, which constrains the attack surface. However, once authenticated, an attacker can extract data, alter records, or pivot further into the application logic. Because SeaCMS is widely deployed as a Chinese-language video content management system, exposed admin interfaces remain a common target for credential-based attacks that precede this exploitation step.

Root Cause

The root cause is improper input neutralization in the cron task management handler. The application fails to validate or escape the resourcefrom and collectID request parameters before incorporating them into SQL queries. PHP database access in the affected code path uses string concatenation rather than prepared statements, allowing standard SQL injection payloads to alter query semantics.

Attack Vector

The attack is delivered remotely over HTTP/HTTPS to the SeaCMS administrative interface. An attacker authenticated as an administrator submits crafted values for resourcefrom or collectID to /admin_cron.php. Public disclosure includes proof-of-concept details available through GitHub Issue Discussion and VulDB CTI Item #326112. No working exploit module is currently listed in Exploit-DB, and the EPSS score remains low at 0.043%.

The vulnerability manifests when attacker-controlled values are interpolated into the cron task SQL query. Refer to the VulDB submission for technical reproduction details.

Detection Methods for CVE-2025-11071

Indicators of Compromise

• HTTP requests to /admin_cron.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, /*) in the resourcefrom or collectID parameters.
• Unexpected administrative sessions originating from unfamiliar IP addresses or geographies.
• Anomalous database query patterns or extended response times from the SeaCMS backend during cron task operations.

Detection Strategies

• Inspect web server access logs for admin_cron.php requests with non-numeric collectID values or encoded SQL syntax in resourcefrom.
• Deploy Web Application Firewall (WAF) rules that flag classic SQL injection signatures targeting the SeaCMS admin path.
• Correlate authentication events with subsequent administrative actions to identify credential abuse preceding exploitation.

Monitoring Recommendations

• Enable verbose logging on the SeaCMS administrative interface and forward logs to a centralized analytics platform.
• Monitor database error rates and query latency on the MySQL backend serving SeaCMS.
• Alert on repeated 4xx or 5xx responses from /admin_cron.php, which may indicate injection probing.

How to Mitigate CVE-2025-11071

Immediate Actions Required

• Restrict access to the SeaCMS administrative interface using IP allowlists, VPN gateways, or reverse proxy authentication.
• Rotate administrator credentials and enforce strong, unique passwords with multi-factor authentication where supported.
• Audit all administrator accounts and remove unused or stale privileged users.

Patch Information

No official vendor patch advisory is currently listed in the enriched CVE references. Operators should monitor the SeaCMS project and vendor channels for an updated release addressing the injection in /admin_cron.php. Until a fixed version is published, apply compensating controls.

Workarounds

• Block external access to /admin_cron.php at the web server or WAF layer until a patch is available.
• Apply input validation rules that reject non-numeric values for collectID and constrain resourcefrom to a known allowlist.
• Place the SeaCMS administrative path behind an additional authentication layer such as HTTP Basic auth or mutual TLS.

# Example nginx configuration restricting admin_cron.php access
location = /admin_cron.php {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "SeaCMS Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}