Unauthenticated SQL Injection in SeaCMS Comment API

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SeaCMS versions through 8.7 contain a critical unauthenticated SQL injection vulnerability in the comment API endpoint (/comment/api/index.php) that allows remote attackers to execute arbitrary database queries without authentication. The vulnerability exists in the rlist[] array parameter, which fails to sanitize user input before incorporating it into SQL statements. Attackers exploit this by injecting SQL commands using backtick-quoted variables and extractvalue functions to extract sensitive database information through error-based SQL injection techniques. This vulnerability is particularly dangerous because it requires no authentication, can be triggered via simple GET requests, and was actively exploited in the wild as of October 2023, making it a critical risk for any organization running vulnerable SeaCMS installations.

Casky's 323 matched security skills leverage Claude's extended reasoning to detect the reconnaissance and exploitation patterns associated with this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would identify attack indicators such as: anomalous GET requests to /comment/api/index.php containing suspicious rlist[] parameters with SQL syntax patterns; unusual database error messages in application logs revealing table and column structures; attempts to use extractvalue() or similar SQL exfiltration functions; and timing-based or error-based SQL injection probes. The platform's skills would correlate these signals with known exploitation patterns, helping security teams recognize when attackers are conducting reconnaissance to map database schemas or attempting direct data extraction, enabling faster detection and response before sensitive information is compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2019-25778.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2019-25778

Casky has 323 skills that investigate the attack patterns behind CVE-2019-25778. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn