Description

A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T08:17:19.380Z",
  "pubdate": "2026-10-12T08:17:19.380Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in SEMCMS up to version 5.0. The vulnerability resides within the SEMCMS_Download.php file and allows unauthenticated, remote attackers to execute arbitrary SQL commands against the underlying database.\nThis flaw occurs due to improper neutralization of user-supplied data before incorporating it into database queries. Successful exploitation enables unauthorized actors to bypass authentication, exfiltrate sensitive data, modify database contents, or potentially achieve full administrative control over the application's data layer.\nGiven that the exploit is publicly available and the vendor has remained unresponsive, the risk of exploitation is significantly elevated. Organizations utilizing SEMCMS versions 5.0 or earlier are at high risk of data breaches and compromise of the application's integrity.",
  "technicalDetails": "The vulnerability is a classic SQL injection (SQLi) flaw located within the handling logic of the SEMCMS_Download.php script. The root cause is the failure to adequately sanitize or parameterize user-supplied input before passing it to the database management system. Because the application fails to validate the input parameters effectively, an attacker can inject malicious SQL syntax into the query stream.\nThe exploitation process typically involves a remote attacker crafting a malicious HTTP request directed at the affected file. By manipulating the input parameters that SEMCMS_Download.php processes, the attacker breaks out of the expected data context and appends unauthorized SQL commands. These commands are then executed by the database engine with the privileges of the database user configured for the application.\nThe attack flow proceeds as follows: First, the attacker identifies an input vector within the target script. Second, the attacker submits specially crafted payloads, such as tautologies (e.g., 'OR 1=1') or UNION-based injection strings, to elicit database responses or manipulate query logic. Third, the database evaluates the injected syntax, resulting in unintended operations. If the application is configured to reflect database errors or query output, the attacker can leverage these as an oracle to extract sensitive table information, schema details, or user credentials.\nThis vulnerability is particularly severe because it does not require prior authentication or specialized privileges, meaning the attack surface is exposed to any remote user with network access to the web application. The post-exploitation impact is extensive; beyond simple data exfiltration, an attacker may leverage elevated database permissions to write files to the web server, modify application configurations, or delete critical data. In scenarios where the database user has high system privileges, this may even serve as a vector for complete server compromise. Since the vendor has not provided an official patch, the codebase remains fundamentally susceptible to any entity capable of transmitting HTTP requests to the vulnerable endpoint."
}