CVE-2018-14421

2018-07-1918:00:00

mitre

www.cve.org

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.php). The code is executed by visiting /details/index.php. This can also be exploited through CSRF.

References

hexo.imagemlt.xyz/post/seacms-backend-getshell/index.html