CVE-2024-52725
📋 TL;DR
SemCms v4.8 contains a SQL injection vulnerability in the SEMCMS_SeoAndTag.php component via the ldgid parameter. This allows attackers to execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion. All users running SemCms v4.8 are affected.
💻 Affected Systems
- SemCms
📦 What is this software?
Semcms by Sem Cms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, or deletion; potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access, privilege escalation, or database manipulation.
If Mitigated
Limited impact with proper input validation and database permissions.
🎯 Exploit Status
SQL injection via GET parameter is trivial to exploit; proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://semcms.com
Restart Required: No
Instructions:
Check vendor website for updates; if unavailable, implement workarounds or upgrade to newer version if patched.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize ldgid parameter in SEMCMS_SeoAndTag.php
Edit SEMCMS_SeoAndTag.php and add: $ldgid = intval($_GET['ldgid']);
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:ldgid "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Restrict access to SEMCMS_SeoAndTag.php via firewall rules
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test by accessing SEMCMS_SeoAndTag.php?ldgid=1' OR '1'='1 and checking for SQL errorsCheck Version:
Check SemCms version in admin panel or readme filesVerify Fix Applied:
Test same payload after fix; should return normal response without errors📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
Network Indicators:
- HTTP requests with SQL keywords in ldgid parameter
- Multiple rapid requests to SEMCMS_SeoAndTag.php
SIEM Query:
source="web_logs" AND uri="/SEMCMS_SeoAndTag.php" AND (query CONTAINS "' OR" OR query CONTAINS "UNION" OR query CONTAINS "SELECT")