External risk intelligence

SeaCMS Command Execution Vulnerability in admin_safe.php

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-46010

SeaCMS is a content management system designed to be deployed as a public-facing web application. Components within such systems, including administrative interfaces, are commonly exposed or reachable via the internet as part of the standard deployment pattern for web services.

Code Injection

Seacms

12.9 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in SeaCMS allows an unauthenticated attacker to run any command on the system by exploiting a flaw in the admin_safe.php file. This could potentially lead to a complete compromise of the affected website and its underlying server infrastructure.

Attacker can run any command.
Public-facing web applications are targeted.
Confirm if SeaCMS is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request to the admin_safe.php component of SeaCMS. This component is accessible over the network without requiring any user interaction or prior authentication. Successful exploitation allows the attacker to execute arbitrary commands on the affected system.

No authentication or user interaction needed.
Vulnerable admin_safe.php component.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected system by leveraging a flaw in the admin_safe.php component. This could lead to a complete compromise of the server.

System commands and configurations.
Via an exposed admin component.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and application owners for SeaCMS deployments are likely responsible for addressing this vulnerability. The first practical step is to identify all instances of SeaCMS, determine their exposure and business criticality, and then assign ownership for remediation planning.

Application owners should own the issue.
Verify public-facing or business-critical instances.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SeaCMS and why do people use it?

SeaCMS is a content management system (CMS) built to help users host, organize, and stream video content online. It functions as the backend engine for a website, managing media databases and visitor interactions. Because it is designed to serve video libraries to a wide audience, it is typically deployed as a web application accessible over the internet.

What does CVE-2023-46010 mean?

This vulnerability is classified as CWE-94, which refers to improper control of generation of code. In simple terms, the software fails to properly sanitize inputs, allowing an unauthorized person to inject and run their own commands on the host server. This flaw in the admin_safe.php component essentially tricks the system into executing malicious instructions as if they were legitimate administrative tasks.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted request to the admin_safe.php file over the network. Crucially, the system does not require the attacker to have a password or be logged in to reach this component. Simply browsing to the vulnerable file with malicious input is enough; standard site interactions or legitimate administrative tasks are not required to activate the flaw.

Why is this CVE relevant to my infrastructure?

According to Halo Surface Signal, SeaCMS is designed to be a public-facing application, meaning its administrative components are often reachable via the internet. If your instance is exposed to the network, anyone can reach the vulnerable file without authentication. This makes the risk significantly higher for any public-facing server compared to one restricted to a private internal network.

What should I do if I run SeaCMS?

Begin by auditing your environment to locate every instance of SeaCMS. Since the vulnerability allows full control over the underlying server, prioritize checking any instances that are accessible from the internet. Once you have an inventory, confirm the version in use and coordinate with your team to plan an update or restrict access to the affected administrative component while you prepare a permanent fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.