Remote code execution via default-password template injection

Code injection in SeaCMS 13.6 and earlier allows remote attackers to execute PHP code through a deployed Locoy article collector. The collector accepts article content after checking the hard-coded pwd value 123456, and article rendering passes embedded {if:...} syntax to parseIf(), which evaluates it with PHP eval(). Exploitation requires the optional seacms_locoy_news.php interface to be copied into the administrative directory and left with its default password; the injected code runs as the web server process.