SeaCMS Remote Code Execution Vulnerability in admin_ping.php Component

A remote code execution vulnerability has been identified in SeaCMS version 13.3. The issue arises in the admin_ping.php file, where PHP code concatenation is used. Although the component attempts to restrict file editing, these restrictions can be bypassed, allowing authenticated attackers to inject and execute arbitrary code with system privileges.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where SeaCMS is installed.

Reproduction

To reproduce this vulnerability, navigate to the admin_ping.php page in the SeaCMS 13.3 administration panel. Inject PHP code into the 'weburl' field, concatenated with a closing quote and a semicolon, such as '123456789";phpinfo();$a="1'. When the injection is processed, the PHP code will be executed, demonstrating successful exploitation.