Executive brief
SemCms, a content management system used for building e-commerce and corporate websites, contains a security flaw in its link management component. An attacker with basic user access can exploit this to interact directly with the website's database. This could lead to the unauthorized viewing or modification of sensitive business data and potentially allow the attacker to gain administrative control over the database.
Technical details
A SQL injection vulnerability exists in SemCms versions up to and including 5.0. The flaw is located in the 'lgid' parameter within the SEMCMS_Link.php file, which fails to properly sanitize user-supplied input before using it in a SQL query (CWE-89). An attacker with low-privileged network access can exploit this to perform unauthorized database queries. Successful exploitation can lead to the disclosure of sensitive information, modification of database records, and in some configurations, the acquisition of database administrator (DBA) privileges. A Proof of Concept (PoC) has been disclosed by third-party researchers.
Affected products
- SemCms SemCms <= 5.0
Timeline
- 2025-07-14: advisory: Initial disclosure of CVE-2025-51657