CVE-2025-3792: SeaCMS SQL Injection Vulnerability

CVE-2025-3792 Overview

CVE-2025-3792 is a SQL injection vulnerability affecting SeaCMS versions up to 13.3. The flaw resides in the /admin_link.php?action=delall endpoint, where the e_id parameter is passed to a database query without proper sanitization. Attackers with authenticated administrative access can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic use against exposed installations. This weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can inject arbitrary SQL commands through the e_id parameter, potentially reading, modifying, or deleting data stored in the SeaCMS database.

Affected Products

SeaCMS versions up to and including 13.3
/admin_link.php administrative link management component
Deployments exposing the SeaCMS admin interface to untrusted networks

Discovery Timeline

2025-04-18 - CVE-2025-3792 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3792

Vulnerability Analysis

The vulnerability affects the link deletion routine invoked when action=delall is supplied to admin_link.php. The handler accepts an e_id argument from the request and concatenates it into a SQL statement without parameterization or type validation. An attacker with access to the admin interface can supply crafted input in e_id to break out of the intended query context and execute additional SQL clauses.

Successful exploitation can be used to extract administrator credentials, enumerate database schema, or manipulate content served by the SeaCMS installation. Because SeaCMS is deployed as a public-facing content management platform, compromise of the database can cascade into defacement, content tampering, or lateral movement into the underlying server. The publicly available proof of concept lowers the barrier to exploitation.

Root Cause

The root cause is a failure to sanitize or parameterize user-controlled input before it reaches the SQL query builder. The e_id parameter, expected to represent a numeric identifier, is inserted directly into the query string handled by the deletion routine.

Attack Vector

The attack is delivered remotely over HTTP against the admin_link.php endpoint. Exploitation requires authenticated administrative privileges, which limits opportunistic mass exploitation but remains significant in scenarios involving credential reuse, weak admin passwords, or chained authentication bypasses. Refer to the GitHub PoC Repository for technical exploitation details.

Detection Methods for CVE-2025-3792

Indicators of Compromise

HTTP requests to /admin_link.php containing action=delall with non-numeric or SQL metacharacter payloads in the e_id parameter
Unexpected UNION, SELECT, SLEEP, or comment sequences (--, #) appearing in web server access logs for admin endpoints
Anomalous outbound database queries or content changes originating from the SeaCMS admin session

Detection Strategies

Deploy web application firewall rules that inspect the e_id parameter for SQL syntax and reject non-integer values
Enable database query logging to identify malformed or unusually long DELETE statements targeting the link table
Correlate admin authentication events with subsequent SQL errors returned by the application

Monitoring Recommendations

Alert on repeated 500-level responses from admin_link.php that may indicate injection probing
Monitor administrator account activity for logins from unfamiliar IP addresses followed by requests to link management endpoints
Track database user activity for schema enumeration queries against information_schema

How to Mitigate CVE-2025-3792

Immediate Actions Required

Restrict access to the SeaCMS /admin/ directory using network ACLs, VPN, or IP allowlisting
Rotate all administrator credentials and enforce strong password policies with multi-factor authentication where supported
Review database and web server logs for prior exploitation attempts referencing e_id

Patch Information

No vendor patch has been referenced in the NVD entry at the time of publication. Review the VulDB advisory for the latest remediation status and monitor the SeaCMS project for updated releases beyond version 13.3.

Workarounds

Place SeaCMS behind a reverse proxy or WAF that enforces strict type validation on the e_id parameter
Apply a virtual patch that rejects any request to /admin_link.php?action=delall where e_id is not an integer
Reduce the privileges of the database account used by SeaCMS so that destructive SQL operations are limited

bash

# Example nginx rule to block non-numeric e_id values
location = /admin_link.php {
    if ($arg_action = "delall") {
        if ($arg_e_id !~ "^[0-9]+$") {
            return 403;
        }
    }
}