1150 matches found
CVE-2018-14517
SeaCMS 6.61 contains two reflected XSS flaws in admin_config.php form fields. Reports (NVD, CNVD) describe remote exploitation leading to arbitrary script/HTML execution in affected installations. Root cause: improper input handling in admin_config.php; impact includes user session or data exposu...
CVE-2018-14517
SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...
SeaCMS Cross-Site Scripting Vulnerability (CNVD-2018-14092)
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the adminconfig.php file in SeaCMS version 6.61. A remote attacker can exploit this vulnerabili...
seacms 后台getshell
作为只是审计过几次CTF线下赛的代码审计小菜鸟，暑假决定正式开始练习一些CMS的代码审计，于是便挑了SeaCMS这样一款cms进行审计，由于缺乏经验于是选择首先审计后台方面的漏洞，说实话在SeaCMS的后台部分的防护确实较少，发现了许多后台的SQL注入。。。。。后来参考SeaCMS之前的一些漏洞，终于找到了这样一个后台插入if标签从而getshell的后台getshell漏洞点。 首先演示一下整个getshell的流程： 登录面板，进入添加电影的界面，在此界面添加电影，设置图片url为if:1$GLOBALS'G'.'ET'a;//end if;...
CVE-2018-14421
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
CVE-2018-14421
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
Cross site request forgery (csrf)
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
SeaCMS Remote Code Execution Vulnerability
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit the vulnerability to execute code...
CVE-2018-14421
SeaCMS v6.61 contains a Remote Code Execution vulnerability. An attacker can place PHP code in the movie picture address (v_pic) passed to /admin/admin_video.php (aka /backend/admin_video.php), which gets executed when visiting /details/index.php. The issue can also be exploited via CSRF, enablin...
CVE-2018-14421
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
SeaCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-14275)
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site request forgery vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit this vulnerability to add an...
SeaCMS Cross-Site Request Forgery Vulnerability
SeaCMS Ocean CMS is a professional open source free PHP film and television system. SeaCMS version 6.61 suffers from a cross-site request forgery vulnerability, which can be exploited by an attacker to add a user account via adm1n/adminmanager.php?action=add...
CVE-2018-13444
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/adminmanager.php?action=save&id=2...
CVE-2018-13445
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/adminmanager.php?action=add...
Cross site request forgery (csrf)
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/adminmanager.php?action=save&id=2...
CVE-2018-13444
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/adminmanager.php?action=save&id=2...
Cross site request forgery (csrf)
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/adminmanager.php?action=add...