Description

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T08:17:19.187Z",
  "pubdate": "2026-10-12T08:17:19.187Z",
  "executiveSummary": "A critical security vulnerability has been identified in SEMCMS up to version 5.0, involving an improper authorization flaw.\nThe vulnerability originates in the /admin/SEMCMS_User.php file when the Class parameter is set to Deleted and the CF parameter is set to user.\nThis flaw allows remote, unauthenticated attackers to trigger unauthorized actions due to a failure in the application's access control mechanisms.\nThe vulnerability is currently known to the public, and exploit code exists, increasing the risk of exploitation by malicious actors.\nGiven the lack of vendor response to early disclosure efforts, users remain exposed without an official security patch.\nThe primary risk implication is the potential for unauthorized administrative operations, potentially leading to data manipulation or administrative compromise of the affected SEMCMS instance.",
  "technicalDetails": "The vulnerability resides within the SEMCMS administrative interface, specifically targeting the /admin/SEMCMS_User.php script. The issue is classified as improper authorization (CWE-285).\nThe root cause is a deficiency in the application's access control logic, which fails to adequately verify the session integrity or the privilege level of the requester when specific URL parameters are provided.\nThe attack is executed by making a direct, remote HTTP request to the vulnerable endpoint with the parameters Class=Deleted and CF=user. When these parameters are passed to the script, the application's back-end logic fails to perform a secondary validation check to ensure the user is logged in as an administrator or possesses the required administrative permissions for the 'Deleted' function.\nBecause the function is accessible without sufficient authorization, an attacker can trigger the intended functionality—presumably a deletion process—remotely. The lack of granular access control at the functional level allows the application to proceed with the requested operation based solely on the input parameters provided in the URL query string.\nThe attack flow proceeds as follows: 1) The attacker targets a remote instance of SEMCMS. 2) The attacker crafts an HTTP request targeting /admin/SEMCMS_User.php?Class=Deleted&CF=user. 3) The application processes the request, identifying the 'Deleted' Class and 'user' CF parameters. 4) The server-side script executes the deletion logic without validating the user's authentication token or administrative session status. 5) The requested operation is successfully executed on the server, resulting in unauthorized state changes within the application.\nThis vulnerability is particularly severe because it allows for unauthorized manipulation of administrative functions remotely without requiring prior knowledge of credentials or active administrative sessions. The post-exploitation impact includes the potential unauthorized removal of administrative users or data, leading to a compromise of the application's integrity and potential service disruption. There is no evidence of authentication or complex privilege requirements for triggering this execution path, making the barrier to entry extremely low for an attacker."
}