CVE-2017-17561 — HIGH (7.2)

Vulnerability Description

SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.

CVSS Score

7.2

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Seacms Project	Seacms	6.56

References

http://www.jianshu.com/p/35af80b97ee6ExploitIssue TrackingThird Party Advisory
https://gist.github.com/WangYihang/9507e2efdceb67a5bc2761200f19f213ExploitIssue TrackingThird Party Advisory
http://www.jianshu.com/p/35af80b97ee6ExploitIssue TrackingThird Party Advisory
https://gist.github.com/WangYihang/9507e2efdceb67a5bc2761200f19f213ExploitIssue TrackingThird Party Advisory

FAQ

What is CVE-2017-17561?

CVE-2017-17561 is a vulnerability with a CVSS score of 7.2 (HIGH). SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.

How severe is CVE-2017-17561?

CVE-2017-17561 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-17561?

Check the references section above for vendor advisories and patch information. Affected products include: Seacms Project Seacms.