CVE-2025-3797: Seacms SQL Injection Vulnerability

CVE-2025-3797 Overview

CVE-2025-3797 is a SQL injection vulnerability affecting SeaCMS versions up to 13.3. The flaw resides in the /admin_topic.php?action=delall endpoint, where the e_id parameter is passed to a database query without proper sanitization. Authenticated attackers with high privileges can manipulate the parameter to inject arbitrary SQL statements over the network. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed SeaCMS deployments. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Remote SQL injection through the e_id parameter in admin_topic.php enables attackers to read, modify, or delete backend database content within SeaCMS installations.

Affected Products

• SeaCMS versions up to and including 13.3
• SeaCMS administrative interface (admin_topic.php)
• Deployments exposing the admin panel to untrusted networks

Discovery Timeline

• 2025-04-19 - CVE-2025-3797 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3797

Vulnerability Analysis

The vulnerability exists in the delall action handler within admin_topic.php. The handler accepts an e_id argument from the HTTP request and incorporates it into a SQL query without parameterization or input validation. An attacker who controls the e_id value can break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires administrative authentication, which limits the unauthenticated attack surface. However, credential reuse, weak default passwords, or compromised admin sessions can satisfy this prerequisite. Once exploited, the attacker can extract sensitive data such as user credentials, modify CMS content, or execute follow-on attacks against the backing database.

The public disclosure on VulDB and the GitHub CVE Documentation provides reproduction details, lowering the barrier for exploitation.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a downstream SQL interpreter. The delall branch concatenates the e_id parameter directly into a DELETE-style SQL statement rather than binding it as a typed parameter. Missing input validation and the absence of prepared statements allow injection of arbitrary SQL syntax through standard HTTP requests.

Attack Vector

The attack vector is network-based via HTTP requests to the SeaCMS administrative interface. An authenticated administrative user submits a crafted request to /admin_topic.php?action=delall containing a malicious e_id value. The injected SQL is executed by the backend database with the privileges of the SeaCMS database user.

No verified exploit code is included here. Refer to the VulDB entry #305650 and the GitHub CVE Documentation for published technical analysis.

Detection Methods for CVE-2025-3797

Indicators of Compromise

• HTTP requests to /admin_topic.php?action=delall containing SQL metacharacters such as ', --, UNION, or SLEEP( in the e_id parameter
• Unexpected DELETE or SELECT statements in MySQL query logs originating from the SeaCMS application user
• Anomalous administrative session activity from unfamiliar IP addresses or geolocations
• Database errors logged by SeaCMS referencing syntax errors during topic deletion operations

Detection Strategies

• Inspect web server access logs for action=delall requests with non-numeric or encoded e_id values
• Deploy a web application firewall rule that blocks SQL injection signatures against the SeaCMS admin path
• Enable MySQL general query logging temporarily to identify malformed queries against topic tables
• Correlate admin authentication events with subsequent suspicious database activity

Monitoring Recommendations

• Alert on repeated 500-series HTTP responses from admin_topic.php indicating injection probing
• Monitor for outbound database connections or data exfiltration patterns following admin logins
• Track administrative account logins from new devices, user agents, or network ranges

How to Mitigate CVE-2025-3797

Immediate Actions Required

• Restrict access to the SeaCMS /admin/ directory using IP allowlists or VPN-only access
• Audit administrative accounts and rotate credentials, enforcing strong password policies
• Review web server and database logs for prior exploitation attempts against admin_topic.php
• Apply database least-privilege so the SeaCMS user cannot read or modify tables outside its scope

Patch Information

No official vendor patch reference is listed in the NVD entry at the time of writing. Administrators should monitor the SeaCMS project and VulDB submission #554660 for vendor remediation updates. Until a fix is published, treat the application as vulnerable on all versions through 13.3.

Workarounds

• Place the SeaCMS admin interface behind a reverse proxy enforcing authentication and source IP restrictions
• Deploy WAF rules blocking SQL metacharacters in the e_id parameter of the delall action
• Disable or remove the admin_topic.php script if the topic management feature is unused
• Apply virtual patching by inserting input validation in a custom request filter that rejects non-integer e_id values

# Example nginx configuration restricting admin access
location ~ ^/admin_topic\.php {
    allow 10.0.0.0/8;
    deny all;
    if ($arg_e_id !~ "^[0-9]+$") { return 403; }
}