1344 matches found
CVE-2018-14910
SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address aka ip to /admin/adminip.php aka /adm1n/adminip.php. The code is executed by visiting adm1n/adminip.php or data/admin/ip.php. This can also be exploited through CSRF...
CVE-2018-14910
SeaCMS v6.61 is vulnerable to Remote Code Execution. An attacker can place PHP code via an allowed IP address (ip) that targets /admin/admin_ip.php (also reachable as /adm1n/admin_ip.php). The payload is executed when an affected endpoint is accessed (adm1n/admin_ip.php or data/admin/ip.php), ena...
CVE-2018-14910
SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address aka ip to /admin/adminip.php aka /adm1n/adminip.php. The code is executed by visiting adm1n/adminip.php or data/admin/ip.php. This can also be exploited through CSRF...
CVE-2018-14910: Improper Control of Generation of Code
SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address aka ip to /admin/adminip.php aka /adm1n/adminip.php. The code is executed by visiting adm1n/adminip.php or data/admin/ip.php. This can also be exploited through CSRF...
Code Execution Vulnerability in the background of seacms website builder system
seacms is a video-on-demand system based on PHP+MySql technology. There is a code execution vulnerability in the backend of seacms website builder system, which can be exploited by attackers to execute remote code...
CVE-2018-14517
SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...
Design/Logic Flaw
SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...
CVE-2018-14517
SeaCMS 6.61 contains two reflected XSS flaws in admin_config.php form fields. Reports (NVD, CNVD) describe remote exploitation leading to arbitrary script/HTML execution in affected installations. Root cause: improper input handling in admin_config.php; impact includes user session or data exposu...
CVE-2018-14517
SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...
seacms 后台getshell
作为只是审计过几次CTF线下赛的代码审计小菜鸟，暑假决定正式开始练习一些CMS的代码审计，于是便挑了SeaCMS这样一款cms进行审计，由于缺乏经验于是选择首先审计后台方面的漏洞，说实话在SeaCMS的后台部分的防护确实较少，发现了许多后台的SQL注入。。。。。后来参考SeaCMS之前的一些漏洞，终于找到了这样一个后台插入if标签从而getshell的后台getshell漏洞点。 首先演示一下整个getshell的流程： 登录面板，进入添加电影的界面，在此界面添加电影，设置图片url为if:1$GLOBALS'G'.'ET'a;//end if;...
SeaCMS Cross-Site Scripting Vulnerability (CNVD-2018-14092)
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the adminconfig.php file in SeaCMS version 6.61. A remote attacker can exploit this vulnerabili...
CVE-2018-14517: Improper Neutralization of Input During Web Page Generation
SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...
CVE-2018-14421
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
CVE-2018-14421
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
Cross site request forgery (csrf)
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
SeaCMS Remote Code Execution Vulnerability
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit the vulnerability to execute code...
CVE-2018-14421
SeaCMS v6.61 contains a Remote Code Execution vulnerability. An attacker can place PHP code in the movie picture address (v_pic) passed to /admin/admin_video.php (aka /backend/admin_video.php), which gets executed when visiting /details/index.php. The issue can also be exploited via CSRF, enablin...
CVE-2018-14421
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
CVE-2018-14421: Improper Control of Generation of Code
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...