Is CVE-2019-25778 being exploited?

No public exploit is currently tracked.

How severe is CVE-2019-25778?

CVE-2019-25778 has a CVSS v3 severity of HIGH (8.2).

Back

CVE-2019-25778

Description

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.