CVE-2019-25778

SeaCMS versions up to and including 8.7 are vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists in the rlist[] array parameter, where remote attackers can manipulate database queries by sending crafted GET requests to /comment/api/index.php. By using backtick-quoted vari...