CVE-2026-82600 Overview
CVE-2026-82600 is a SQL injection vulnerability affecting SeaCMS versions up to 13.6. The flaw resides in the /zyapi.php?ac=videolist endpoint, where the ids parameter is passed to a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements against the backend database. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against unpatched deployments. This weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Unauthenticated remote attackers can extract, modify, or delete database contents by injecting SQL through the ids parameter of the videolist API endpoint.
Affected Products
- SeaCMS versions up to and including 13.6
- SeaCMS /zyapi.php API component
- Deployments exposing the videolist action to untrusted networks
Discovery Timeline
- 2026-08-31 - CVE-2026-82600 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82600
Vulnerability Analysis
The vulnerability exists in the videolist action handler within /zyapi.php. The handler accepts an ids argument from the HTTP request and incorporates the value directly into a SQL query without parameterization or input validation. An attacker supplying crafted SQL syntax in the ids argument can alter the query structure and execute attacker-controlled statements against the SeaCMS database.
Successful exploitation allows read access to sensitive tables including administrator credentials, session tokens, and content records. Depending on database privileges, an attacker may also write to tables or trigger secondary attacks such as stored cross-site scripting through injected content. The endpoint is reachable over the network without authentication, which lowers the barrier to exploitation.
Root Cause
The root cause is improper neutralization of special SQL characters in the ids request parameter before it is concatenated into a database query. SeaCMS relies on string interpolation for query construction in this code path rather than prepared statements with bound parameters. Any single-quote, comment sequence, or UNION-style construct submitted by the client passes through to the SQL parser intact.
Attack Vector
Exploitation is performed over HTTP by issuing a GET or POST request to /zyapi.php?ac=videolist with a malicious ids value. The attack requires no authentication, no user interaction, and can be executed remotely against any exposed SeaCMS instance up to version 13.6. Public exploit material is referenced in the GitHub Security Advisory for this CVE.
The vulnerability manifests in the videolist request handler. Refer to the linked advisory for the specific request format and payload structure used to demonstrate injection.
Detection Methods for CVE-2026-82600
Indicators of Compromise
- HTTP requests to /zyapi.php?ac=videolist containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, OR 1=1, or inline comments in the ids parameter.
- Unusually long or URL-encoded ids parameter values in web server access logs.
- Database error messages or stack traces returned in HTTP responses from zyapi.php.
- Outbound queries from the SeaCMS database process targeting sensitive tables outside normal application workflows.
Detection Strategies
- Deploy web application firewall signatures that flag SQL syntax in the ids parameter of /zyapi.php requests.
- Enable database query logging and alert on queries referencing the videolist code path with UNION, INFORMATION_SCHEMA, or time-based sleep functions.
- Correlate spikes in HTTP 500 responses from zyapi.php with parameter values containing suspicious characters.
Monitoring Recommendations
- Baseline normal ids parameter values (typically numeric or comma-separated integer lists) and alert on deviations.
- Forward web server and MySQL logs to a centralized analytics platform for retention and search.
- Monitor for administrator account activity that does not align with legitimate operator behavior following suspicious zyapi.php traffic.
How to Mitigate CVE-2026-82600
Immediate Actions Required
- Restrict network access to /zyapi.php using firewall rules or reverse proxy allow-lists until a patched release is deployed.
- Apply a web application firewall rule that rejects requests where the ids parameter contains non-numeric characters.
- Audit the SeaCMS database for unauthorized administrator accounts, modified content, or evidence of data exfiltration.
- Rotate administrator credentials, API tokens, and any secrets stored in the SeaCMS database.
Patch Information
At the time of publication, no vendor-supplied patch is referenced in the NVD entry. Administrators should monitor the SeaCMS project channels and the VulDB CVE Record for updated fix information. Review the GitHub Security Advisory for technical remediation guidance.
Workarounds
- Modify the videolist handler in zyapi.php to cast the ids argument to an integer array before use in SQL queries.
- Replace string interpolation with parameterized queries or prepared statements across the API layer.
- Disable the zyapi.php endpoint entirely if the video list API is not required in production.
- Enforce least-privilege database accounts so the SeaCMS runtime user cannot access unrelated schemas or execute administrative statements.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
