CVE-2020-18078
📋 TL;DR
This vulnerability in SEMCMS v3.8 allows unauthenticated attackers to reset the administrator password via a flaw in /include/web_check.php. Attackers can gain administrative access to the CMS, affecting all SEMCMS v3.8 installations with the vulnerable file present.
💻 Affected Systems
- SEMCMS
📦 What is this software?
Semcms by Sem Cms
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the CMS with administrative privileges, allowing data theft, defacement, malware injection, and lateral movement to connected systems.
Likely Case
Administrative account takeover leading to website defacement, data exfiltration, or installation of backdoors for persistent access.
If Mitigated
Limited impact if proper network segmentation, web application firewalls, and monitoring are in place to detect and block exploitation attempts.
🎯 Exploit Status
The exploit requires sending a crafted HTTP request to the vulnerable endpoint. Public proof-of-concept code is available in GitHub repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Check for updated SEMCMS version beyond v3.8. 2. If no official patch exists, manually remove or secure /include/web_check.php. 3. Consider migrating to a different CMS if SEMCMS is no longer maintained.
🔧 Temporary Workarounds
Remove vulnerable file
linuxDelete or rename the vulnerable /include/web_check.php file to prevent exploitation
rm /path/to/semcms/include/web_check.php
mv /path/to/semcms/include/web_check.php /path/to/semcms/include/web_check.php.bak
Restrict file access
allConfigure web server to block access to the vulnerable PHP file
# Apache: Add to .htaccess
<Files "web_check.php">
Order Allow,Deny
Deny from all
</Files>
# Nginx: Add to server block
location ~ /include/web_check\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict network access controls to limit access to SEMCMS administration interface
- Deploy web application firewall with rules to block requests to /include/web_check.php
🔍 How to Verify
Check if Vulnerable:
Check if /include/web_check.php exists in SEMCMS installation directory and examine its contents for password reset functionalityCheck Version:
Check SEMCMS version in configuration files or admin panelVerify Fix Applied:
Attempt to access /include/web_check.php and verify it returns 403/404 error or is no longer present📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /include/web_check.php with POST parameters
- Unusual administrator password reset or login events
- Multiple failed login attempts followed by successful admin login
Network Indicators:
- POST requests to /include/web_check.php endpoint
- Unusual traffic patterns to CMS administration interface
SIEM Query:
source="web_server" AND (url="/include/web_check.php" OR url="*web_check.php*")