CVE-2025-50592 Overview
CVE-2025-50592 is a reflected cross-site scripting (XSS) vulnerability in SeaCMS versions prior to 13.2. The flaw exists in the Upload/js/player/dmplayer/player component, which fails to sanitize the vid parameter before rendering it in the response. An attacker can craft a malicious URL that executes arbitrary JavaScript in a victim's browser session when the link is visited. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Attackers can execute arbitrary JavaScript in a victim browser, enabling session theft, credential harvesting, and administrative action hijacking against SeaCMS deployments.
Affected Products
- SeaCMS versions prior to 13.2
- Component: Upload/js/player/dmplayer/player
- Vulnerable parameter: vid
Discovery Timeline
- 2025-08-05 - CVE-2025-50592 published to NVD
- 2026-07-05 - Last updated in NVD database
Technical Details for CVE-2025-50592
Vulnerability Analysis
SeaCMS is a Chinese open-source content management system commonly used for video streaming portals. The vulnerability resides in the DMPlayer integration bundled under Upload/js/player/dmplayer/player. The player script accepts a vid request parameter and reflects its value into the HTML document returned to the client without proper encoding or filtering.
Attackers supplying a crafted vid value containing script content cause the browser to execute injected JavaScript in the context of the SeaCMS origin. Successful exploitation requires user interaction, typically clicking a crafted link, and the scope changes because injected script can access content outside the vulnerable component.
Root Cause
The root cause is missing output encoding on the vid parameter. The player endpoint concatenates the raw request value into script or HTML context without applying HTML entity encoding, JavaScript string escaping, or allowlist validation. This classifies as CWE-79, improper neutralization of input during web page generation.
Attack Vector
Exploitation occurs over the network and requires a low-privileged authenticated user to deliver a crafted link to a victim. When the victim loads the URL, the browser executes attacker-controlled script in the SeaCMS session context. Typical impacts include session cookie theft, forced actions in administrative panels, defacement of rendered pages, and phishing overlays presented inside the trusted domain.
The vulnerability is reflected rather than stored, so successful attacks depend on social engineering to deliver the malicious URL. Technical details are available in the GitHub issue for CVE-2025-50592.
Detection Methods for CVE-2025-50592
Indicators of Compromise
- HTTP requests to Upload/js/player/dmplayer/player containing vid parameter values with <script>, javascript:, onerror=, or encoded script payloads.
- Outbound browser requests to attacker-controlled domains originating from SeaCMS pages, indicating active script exfiltration.
- Unexpected administrator session activity following user clicks on externally sourced SeaCMS links.
Detection Strategies
- Deploy web application firewall rules that inspect query strings on the dmplayer/player endpoint for script tags and event handler patterns.
- Enable server access log review for requests to the vulnerable path with abnormally long or URL-encoded vid values.
- Correlate referer headers with external domains to identify link-based delivery of crafted payloads.
Monitoring Recommendations
- Forward SeaCMS access logs to a central SIEM and alert on vid parameter values matching XSS signature patterns.
- Monitor browser Content Security Policy (CSP) violation reports if CSP is enforced on the SeaCMS domain.
- Audit administrative account activity for actions performed shortly after suspicious player URL requests.
How to Mitigate CVE-2025-50592
Immediate Actions Required
- Upgrade SeaCMS to version 13.2 or later, which addresses the vid parameter handling in the DMPlayer component.
- Restrict access to the SeaCMS administration interface using IP allowlists until patching is complete.
- Invalidate active administrator sessions and rotate credentials if suspicious player requests appear in logs.
Patch Information
The vendor fixed the issue in SeaCMS 13.2. Operators should download the current release from the SeaCMS official website and apply the upgrade following the vendor's documented procedure. Verify the component path Upload/js/player/dmplayer/player is updated and that the vid parameter is properly encoded in the patched release.
Workarounds
- Place a reverse proxy or WAF rule in front of SeaCMS that blocks requests to dmplayer/player containing HTML or JavaScript metacharacters in the vid parameter.
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Educate administrators to avoid clicking SeaCMS player links received from untrusted sources until patching is confirmed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
