Remote Code Execution Vulnerability in SeaCMS 12.9 by Fushuling

CVE-2024-40518

Summary

SeaCMS version 12.9 contains a vulnerability that permits remote code execution due to inadequate sanitization of user-input data in the admin_weixin.php file. Specifically, the application directly injects user input into the weixin.php script without proper validation or processing, enabling authenticated attackers to execute arbitrary commands. This oversight not only compromises the integrity of the application but also grants unauthorized system permissions, posing significant risks to affected installations.

References