SeaCMS versions 13.0 through 13.3 are vulnerable to a remote SQL injection attack, which could allow unauthorized database interaction.

This is a SQL injection vulnerability (CWE-89) located in the mysqli.class.php file. An unauthenticated remote attacker can trigger this flaw by sending a crafted request to the application, manipulating the page or limit parameters to execute arbitrary SQL commands.

The vulnerability carries a CVSS score of 7.3, reflecting a high-severity risk due to the lack of required authentication. Successful exploitation may lead to unauthorized data access, potential modification of database contents, or unauthorized information disclosure, which can cause significant reputational damage and regulatory non-compliance.

Immediate Action: Since no specific patch version is currently confirmed, administrators should restrict access to the vulnerable endpoint or contact the vendor for immediate security guidance.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected input in the page and limit parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads targeting the identified parameters.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible risk to the integrity of the backend database. Organizations should treat this as a priority and implement stringent input validation or WAF filtering immediately to prevent unauthorized access while awaiting a vendor-provided security update.