CVE-2025-4257: SeaCMS 13.2 XSS Vulnerability

CVE-2025-4257 Overview

CVE-2025-4257 is a cross-site scripting (XSS) vulnerability in SeaCMS 13.2, an open-source video content management system. The flaw resides in the /admin_pay.php administrative endpoint. Attackers can inject arbitrary script payloads through the cstatus parameter, which the application processes without sufficient sanitization. Exploitation requires low-privileged authenticated access and user interaction, and the attack can be launched remotely over the network. The vulnerability has been publicly disclosed, and technical details are available through the SeaCMS GitHub issue tracker and VulDB.

Critical Impact
Authenticated attackers can inject malicious JavaScript into the administrative interface, enabling session hijacking, credential theft, and unauthorized actions performed in the context of an administrator's browser.

Affected Products

SeaCMS 13.2
SeaCMS administrative component admin_pay.php
Deployments exposing the SeaCMS admin panel to untrusted users

Discovery Timeline

2025-05-05 - CVE-2025-4257 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4257

Vulnerability Analysis

The vulnerability is classified as a reflected cross-site scripting flaw [CWE-79] within the SeaCMS 13.2 administrative payment management module. The admin_pay.php script accepts the cstatus parameter and renders its value back to the response without applying HTML entity encoding or output escaping. As a result, an attacker who supplies a crafted value containing JavaScript payloads causes that content to execute in the browser of any authenticated administrator who processes the request. Because the affected endpoint lives inside the administrative area, successful exploitation runs within a privileged browsing context.

Root Cause

The root cause is missing output sanitization on user-controllable input handled by admin_pay.php. The cstatus argument flows from the HTTP request into the rendered page without being passed through a contextual encoder such as htmlspecialchars(). This violates the principle of treating all request parameters as untrusted before reflecting them into HTML output.

Attack Vector

Exploitation requires an attacker to deliver a crafted URL or form submission that targets /admin_pay.php with a malicious cstatus value. The victim must be an authenticated SeaCMS user with access to the admin panel and must interact with the attacker-supplied link. Once triggered, the injected script executes with the victim's session privileges, enabling actions such as cookie theft, forced administrative operations, or delivery of secondary payloads. No verified proof-of-concept code is published in the enriched data; refer to the SeaCMS GitHub Issue #26 and VulDB entry 307361 for technical details.

Detection Methods for CVE-2025-4257

Indicators of Compromise

HTTP requests to /admin_pay.php containing script tags, event handlers, or URL-encoded JavaScript in the cstatus parameter
Web server access logs showing cstatus values that include characters such as <, >, ", or javascript:
Unexpected outbound requests from administrator browsers immediately after visiting SeaCMS admin URLs

Detection Strategies

Deploy web application firewall rules that inspect query string and POST body parameters submitted to /admin_pay.php for XSS payload patterns
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts within the SeaCMS admin panel
Review PHP application logs for anomalous parameter lengths or non-standard character sets in requests to administrative endpoints

Monitoring Recommendations

Alert on repeated failed or malformed requests to /admin_pay.php originating from a single source
Correlate administrator session activity with subsequent privileged actions to identify session hijacking indicators
Monitor egress traffic from workstations used to administer SeaCMS for connections to unfamiliar domains

How to Mitigate CVE-2025-4257

Immediate Actions Required

Restrict access to the SeaCMS administrative interface using network-level controls or IP allowlisting
Require administrators to access the panel from dedicated, hardened browsing environments
Audit user accounts with access to admin_pay.php and remove unnecessary privileges

Patch Information

No vendor-supplied patch is referenced in the enriched CVE data at the time of publication. Track the SeaCMS GitHub Issue #26 for upstream remediation status and apply any released fix as soon as it becomes available.

Workarounds

Place SeaCMS behind a web application firewall that filters XSS patterns in the cstatus parameter
Enforce a strict Content Security Policy that disallows inline scripts within the admin panel
Instruct administrators not to click SeaCMS admin URLs received from untrusted sources

bash

# Example nginx rule to block suspicious cstatus values reaching admin_pay.php
location /admin_pay.php {
    if ($arg_cstatus ~* "(<|>|script|javascript:|onerror=|onload=)") {
        return 403;
    }
}