CVE-2024-40519

Deeper analysis

SeaCMS version 12.9 contains a remote code execution vulnerability in the admin_smtp.php component. The flaw stems from the script directly concatenating unsanitized user-supplied input and writing it into weixin.php without any filtering or validation, enabling arbitrary code to be injected into the generated file.

Authenticated attackers with low-privileged administrative access can exploit the issue over the network to execute arbitrary commands on the underlying system and obtain full control. The vulnerability carries a CVSS 3.1 base score of 8.8, reflecting its low attack complexity and high impact on confidentiality, integrity, and availability.

The two reference URLs point to the same technical disclosure containing proof-of-concept details but provide no information on official patches or mitigation steps from the vendor. The associated EPSS score has remained flat at 0.0637 with no observable rise since publication.