Executive brief
SemCms, a content management system, contains a security flaw in its administrative user management module. An attacker can trick a logged-in administrator into visiting a malicious website, which then silently triggers actions in the SemCms dashboard without the administrator's knowledge. This could allow an attacker to create new unauthorized accounts or modify existing user permissions, potentially leading to a full takeover of the website.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in SemCms version 5.0 and earlier due to a lack of anti-CSRF token validation in the /admin/semcms_user.php component. The application fails to verify the origin of state-changing POST requests or implement unique session-based tokens for user management operations. An attacker can exploit this by hosting a malicious HTML page that uses an auto-submitting form to target an authenticated administrator's session. Successful exploitation allows the attacker to perform unauthorized administrative actions, such as creating new users or modifying existing account details, with the privileges of the victim administrator. Mitigation requires implementing server-side CSRF token validation and utilizing SameSite cookie attributes.
Affected products
- SemCms SemCms 5.0 and earlier
Timeline
- 2026-06-05: disclosed: Initial discovery and Gist publication
- 2026-06-09: advisory: NVD publication date