CVE-2025-44074

The SQL injection vulnerability (CWE-89) involves insufficient validation or filtering of input data passed to the admin_topic.php component. An attacker can inject malicious SQL code directly into a query executed by the application, manipulating data passed to the database. Due to the AV:N/AC:L/PR:N/UI:N vector, the attack can be performed remotely, without authentication and without user interaction.

An attacker can obtain unauthorized access to data stored in the database, as well as modify or delete data and potentially take control of the database system, which threatens the confidentiality, integrity, and availability of the application.

Patches available from the vendor should be applied in accordance with the references. It is also recommended to restrict access to the admin panel (admin_topic.php) exclusively to trusted IP addresses and implement firewall rules blocking unauthorized access to administrative resources.

SeaCMS version 13.3