SeaCMS Incorrect Access Control Vulnerability Allowing Bulk Account Registration

A logic flaw in SeaCMS version 13.1 has been identified, allowing any user to register accounts in bulk. This vulnerability arises from incorrect access control, which can be exploited by attackers to bypass normal registration limits.

Impact

Exploitation of this vulnerability could lead to unauthorized bulk account creation, potentially allowing for abuse of the platform's user management features or automated actions under the guise of multiple users.

Reproduction

To reproduce this vulnerability, access the registration page and initiate the account registration process. Capture the network request using a tool like a web proxy. The captured request can be modified to change the account number and email address, allowing for the registration of multiple accounts in quick succession.