SeaCMS CVE-2025-15003

Exploitation requires valid high-privilege administrator credentials (PR:H per CVSS vector) to access the SeaCMS admin panel. The specific condition is manipulation of the e_id argument in the admin_video.php file, which means the video management feature must be active and the attacker must have admin-level access to the panel. No default configuration bypass is indicated; this is not a pre-authentication vulnerability. Attack vector is network (AV:N), but authentication is mandatory (PR:H), meaning exploitation cannot occur against unauthenticated instances or lower-privilege user accounts.

While the CVSS 4.0 score appears moderate, the actual exploitation risk is substantially constrained by the PR:H (high privilege) requirement, meaning only authenticated administrators can trigger the vulnerability. The EPSS score of 0.05% (14th percentile) correctly reflects this low practical risk despite public exploit availability. The contradiction between moderate CVSS and very low EPSS is explained by privilege gating: this is not an unauthenticated remote vulnerability but rather a privileged account abuse vector. Attack surface is restricted to organizations running SeaCMS where an attacker has already obtained admin credentials. Automatable exploitation is possible given public POC, but initial admin access represents the harder barrier. The limited impact scope (VC:L, VI:L, VA:L) suggests the vulnerability permits data manipulation within the database but not system-level compromise.

An attacker with stolen or phished SeaCMS admin credentials logs into the admin panel, navigates to the video management section (admin_video.php), and injects SQL code into the e_id parameter. Because the parameter is not sanitized, the injected SQL executes with database privileges, allowing the attacker to exfiltrate sensitive data, modify video records, or potentially pivot to other database tables containing customer or configuration data. The publicly available POC automates this payload delivery.