Remote Code Execution Vulnerability in SeaCMS 12.9 by Fushuling

CVE-2024-40520

Summary

SeaCMS version 12.9 presents a vulnerability that enables remote code execution due to improper handling of user input. Specifically, the admin_config_mark.php file directly splices and writes user-provided data into the inc_photowatermark_config.php file without adequate sanitization or validation. This oversight allows authenticated attackers to exploit the vulnerability, executing arbitrary commands on the server and potentially gaining unauthorized access to sensitive system permissions. It is essential for users of SeaCMS 12.9 to take prompt actions to mitigate this security risk by applying necessary patches or implementing appropriate security controls.

References