SeaCMS Remote Code Execution Vulnerability in admin_ip.php Component

A remote code execution vulnerability has been identified in SeaCMS version 13.3. The issue arises in the admin_ip.php file, where an authenticated attacker can bypass restrictions on edited files. This allows the attacker to inject PHP code, which is then executed with system privileges. The vulnerability exploitation involves manipulating the 'ip' parameter to concatenate and execute arbitrary commands.

Impact

Exploitation of this vulnerability allows for remote code execution on the server, with the executed code running under the web server's privileges.

Reproduction

To reproduce this vulnerability, an authenticated user must send a POST request to '0omeqd/admin_ip.php' with the 'action' parameter set to 'set'. The 'ip' parameter should be crafted to include PHP code, such as a command injection payload. Once the request is processed, the injected code will be executed when the 'data/admin/ip.php' file is accessed.