Path Traversal in SeaCMS Comment Cache

Executive Summary

This vulnerability affects SeaCMS up to version 13.6. It allows authenticated members to perform path traversal and delete arbitrary files via the member.php file when the action=del_pl parameter is used. The itype and vid parameters are concatenated into a file path without validation, enabling deletion of .js files outside the intended cache directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual file deletion activity in SeaCMS directories, particularly in the /member.php?action=del_pl endpoint. Check web server logs for requests containing path traversal sequences like ../../../ in the itype or vid parameters. Use commands like grep to search logs for suspicious patterns: grep -r "action=del_pl" /var/log/apache2/ or grep -r "../../../" /var/log/nginx/.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low-privileged member access could delete critical files on the server, including JavaScript files, leading to potential website disruption or further exploitation. The attack requires authentication but no user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized file deletion, which may lead to data loss or integrity issues. If sensitive data files are deleted, it could violate GDPR's integrity and availability principles or HIPAA's requirements for maintaining protected health information integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SeaCMS to the latest version if available. If not, restrict access to the /member.php?action=del_pl endpoint via web server rules. Validate and sanitize the itype and vid parameters to prevent path traversal. Ensure file operations are restricted to intended directories and suppress error messages during deletions.

Useful 0 Not Useful 0