A critical code injection vulnerability in SeaCMS allows unauthenticated remote attackers to execute arbitrary system commands on the host server.

The application is susceptible to code injection within the Template Engine. Specifically, the search.php file processes user-supplied input through the parseIf function, which executes the input as PHP code via an eval statement, allowing unauthenticated remote command execution.

Successful exploitation grants an attacker full remote code execution capabilities with the privileges of the web server user. This could lead to a complete system compromise, unauthorized access to sensitive application data, and the potential for lateral movement within the network. Despite the provided CVSS score of 7.3, the ability to achieve remote command execution without authentication represents a severe risk to organizational security and data integrity.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the search.php endpoint at the network or web server level. Disable the vulnerable search functionality if it is not business-critical until an official security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious GET requests containing PHP syntax, backticks, or system command patterns (e.g., id, pwd, system) within the searchtype, area, or yuyan parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block malicious payloads containing PHP expressions or common command injection sequences in HTTP request parameters.

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's published technical write-up on GitHub.

Given the ease of exploitation and the critical nature of remote code execution, this vulnerability poses an immediate threat to any exposed SeaCMS instance. Organizations must prioritize restricting access to the affected components and monitor for any signs of exploitation until a permanent vendor patch is applied.