CVE-2026-85138 Details
Description
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
A SQL injection vulnerability has been identified in SeaCMS versions through 13.6, specifically within the WeChat module. The issue arises in the 'weixin/index.php' file, where the 'addslashes' function is applied to incoming XML data before it is parsed. This manipulation allows XML character entities to be decoded and injected into SQL queries, creating a potential for SQL injection attacks. The vulnerability can be exploited remotely, and the exploit is publicly available.
To address this vulnerability, verify the WeChat 'signature', 'timestamp', and 'nonce' for each POST message before processing. Additionally, parse XML data first and use parameterized SQL queries to prevent injection. Avoid using 'addslashes()' for SQL injection defense, and do not decode XML entities before SQL query execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-003-weixin-xml-entity-sqli.md | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-85138 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/892793 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/398365 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/398365/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SeaCMS | 13.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | New CVE Received | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |