CVE-2025-15002 is a high severity SQL injection (CVSS 7.3) in SeaCMS up to version 13.3. It sits in mysqli.class.php, in the dmku player code, and involves the page and limit arguments. The record lists no fix, so restrict access and check the project for a newer release.
What's affected
The record names SeaCMS up to 13.3. The affected file is js/player/dmplayer/dmku/class/mysqli.class.php, and the arguments are page and limit.
- Severity: High, CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Network reachable, low complexity, no privileges or user interaction needed.
- Impact is scored low for confidentiality, integrity and availability.
- Fixed version: none stated in the record. Check the project's release notes.
- Exploitation in the wild: not in CISA KEV. The record says the exploit has been disclosed to the public.
The record links one public write up. This post does not reproduce its details.
How to check if you're exposed
Find your SeaCMS version in the admin panel or in the project's version file, then see whether the player component is present.
# Is the dmku component on disk?
find /var/www -path "*dmplayer/dmku*" -name "mysqli.class.php" 2>/dev/null
# Any requests to the component in your logs?
grep "dmku" /var/log/nginx/access.log | tail -n 50
If the file exists and your version is 13.3 or earlier, you are in the range. If you removed the dmku player feature and the directory is gone, this specific file is not reachable on that site.
Read the log lines for odd characters and very long values in the page and limit arguments. Something unusual is a reason to dig further, and does not by itself show a breach.
What to do now
- Identify every SeaCMS site you operate, with its version.
- Check the project's site for a release later than 13.3 that addresses this CVE. The record does not name one, so confirm in the release notes before you rely on it.
- If the dmku player is not in use, remove the dmku directory or block web access to it.
- Put a rule at your web server or proxy that rejects non numeric values for
pageandlimiton that path. - Make sure the database user for the site has no rights beyond what the site needs.
- Take a backup before any change, and review logs since 2025-12-21.
- Keep the CMS and its plugins on a regular update schedule.
Why it matters
The weakness is CWE-89, SQL injection, within CWE-74. Arguments like page and limit are numbers in intent, which makes them an easy place to forget to bind a value. A pagination parameter is typically dropped straight into a query string, and developers treat it as harmless.
A content management system also tends to hold more than the page you see: user records, hashed passwords, site settings. A low per request score does not capture what the database as a whole holds, which is why database privileges and backups matter.
Quick check
Is SeaCMS 13.4 or later safe?
The record does not say. It names versions up to 13.3 and lists no fix. Check the project's release notes and test before you rely on any later version.
Why are page and limit risky?
They look like harmless numbers, so code often adds them to a query without binding them. Casting them to integers and using parameters closes that gap.
Sources
Last reviewed: 19 October 2026.
