SeaCMS Remote Code Execution Vulnerability in admin_template.php

A remote code execution vulnerability exists in SeaCMS version 13.3 within the admin_template.php file. The issue arises because the file allows path traversal, enabling an attacker to write PHP code into certain file types, which can then be executed on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server with the privileges of the web server user.

Reproduction

To reproduce this vulnerability, send a POST request to '0omeqd/admin_template.php' with the 'action=saveCus' parameter. Include a 'filedir' parameter that traverses to '0omeqd/templets/admin_template.htm' and a 'content' parameter with the PHP code to be executed, such as '<?php phpinfo();?>'. After the file is saved, the injected code can be executed by sending a request with 'action=add', which includes the 'admin_template.htm' file, thereby executing the PHP code.