An unauthenticated SQL injection vulnerability in SeaCMS versions 13.0 through 13.6 allows remote attackers to manipulate database query execution, posing a significant risk to data integrity.

The application fails to properly validate the ids parameter in the zyapi.php script, which is concatenated directly into an SQL IN clause. This allows an unauthenticated remote attacker to inject SQL expression syntax, leading to query manipulation.

Successful exploitation of this flaw allows attackers to manipulate backend database queries, which can lead to unauthorized data disclosure or service disruption. While the current implementation limits the impact to query manipulation rather than full database compromise, the CVSS score of 7.3 reflects a high risk that requires immediate attention to maintain the confidentiality and integrity of the application.

Immediate Action: Currently, there is no official patch available; administrators should restrict access to the zyapi.php endpoint or disable the affected functionality until an official update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous GET requests to zyapi.php containing SQL syntax characters, such as plus signs, parentheses, or mathematical expressions, within the ids parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests to /zyapi.php where the ids parameter contains non-numeric characters or suspicious SQL keywords.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's technical write-up linked in the references.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be treated as a high priority. Administrators must implement the suggested WAF rules immediately to mitigate the risk of unauthorized database interaction while awaiting an official security update from the vendor.