SeaCMS CVE-2025-15002

No authentication is required; the CVSS 4.0 vector specifies PR:N and UI:N, indicating the endpoint is accessible to anonymous network users. The sole prerequisite is that the target SeaCMS installation is internet-accessible and includes the DM player component (located at js/player/dmplayer/dmku/), which appears to be bundled by default. No special configuration or elevated privileges are required on the attacker side. Exploitation is limited to installations running SeaCMS 13.3 or earlier; the PHP environment must have the MySQL/MySQLi extension active, which is standard for SeaCMS deployments.

The CVSS 4.0 score of 5.5 (Medium) aligns with the bounded impact metrics (VC:L/VI:L/VA:L) and reflects partial, not full, database access - consistent with SQL injection without direct OS-level code execution. EPSS at 0.05% (15th percentile) is notably low despite public POC availability, suggesting limited in-the-wild targeting to date; even a mid-sized municipal IT team in swidnica running a public-facing SeaCMS site should treat this as a prompt patching item rather than a critical emergency. The E:P supplemental metric in the CVSS 4.0 vector confirms proof-of-concept exploit code is publicly circulating, which lowers the attacker skill bar and could drive opportunistic scanning. No KEV listing exists, meaning active exploitation has not been confirmed by CISA. The PR:N attack vector means any internet-exposed SeaCMS installation is potentially reachable without prior access, but the limited C/I/A impact (all Low) and niche deployment footprint moderate overall organizational risk.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the DM player API endpoint with a malicious page parameter such as 1 UNION SELECT username,password,3 FROM seacms_admin--, causing the unparameterized query in mysqli.class.php to return administrative credential hashes in the response. A public proof-of-concept exists documenting this technique, lowering the bar to script-kiddie-level exploitation.