Executive brief
SemCms, a content management system used for building e-commerce and corporate websites, contains a security flaw in its category management component. An attacker with basic user access can exploit this vulnerability to gain unauthorized access to the underlying database. This could lead to the theft of sensitive business information or full control over the website's data.
Technical details
A SQL injection vulnerability exists in SemCms versions up to and including 5.0. The flaw is located in the 'pid' parameter within the SEMCMS_Infocategories.php script, which fails to properly sanitize user-supplied input before using it in a database query. An authenticated attacker with low-level privileges can exploit this via network requests to execute arbitrary SQL commands. Successful exploitation allows the attacker to read, modify, or delete data within the database, potentially escalating to Database Administrator (DBA) privileges. A proof-of-concept is publicly available.
Affected products
- SemCms SemCms <= 5.0
Timeline
- 2025-07-14: advisory: NVD published the CVE record.
- 2025-07-14: disclosed: Public disclosure of the vulnerability and proof-of-concept on GitHub.