Executive brief
SemCms, a content management system used for building e-commerce and corporate websites, contains a security flaw in its product management component. An attacker with basic user access can exploit this vulnerability to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive business information or the modification of website data.
Technical details
A SQL injection vulnerability exists in SemCms versions up to and including 5.0. The flaw is located in the 'ID' parameter within the SEMCMS_Products.php file. The application fails to properly sanitize user-supplied input before using it in a database query, enabling Boolean-based blind SQL injection. An attacker with low-privileged (authenticated) access can exploit this to extract sensitive information such as database names and user credentials, potentially escalating to DBA-level permissions. As of the advisory date, no official patch has been confirmed, though users are advised to validate and sanitize all input in the affected component.
Affected products
- SemCms SemCms <= 5.0
Timeline
- 2025-07-14: advisory
- 2025-07-14: disclosed