SeaCMS through version 8.7 is vulnerable to an unauthenticated SQL injection that allows remote attackers to manipulate database queries via the rlist[] parameter in /comment/api/index.php. By supplying crafted GET parameters that use backtick-quoted variables and the extractvalue function, an attacker can force error‑based responses and leak sensitive database information without needing to authenticate. This flaw effectively gives attackers read access to the database contents, which could lead to broader compromise if the underlying database user has additional privileges.

Affected releases are SeaCMS versions up to and including 8.7, particularly the comment API component accessed at /comment/api/index.php. The vulnerability exists in SeaCMS distributed from its official site and is documented by multiple third‑party advisories for the 8.7 release. No other versions are listed as affected, so newer releases that remove this fault are presumed safe.

The severity is high with a CVSS score of 8.8, and although an EPSS value is not available, the publicly reported exploitation evidence in October 2023 indicates that attackers can easily exploit the flaw over the network using unauthenticated GET requests. The vulnerability is not currently listed in the CISA KEV catalog, but the combination of a high base score and an open web interface makes it a strong candidate for automated attacks. Given the lack of authentication requirements and the simplicity of the attack vector, the risk to any running SeaCMS instance remains substantial until the flaw is patched or mitigated.