CVE-2025-51653
📋 TL;DR
This SQL injection vulnerability in SemCms v5.0 allows attackers to manipulate database queries through the pid parameter in SEMCMS_ct.php. It affects all users running the vulnerable version of SemCms, potentially exposing sensitive data stored in the CMS database.
💻 Affected Systems
- SemCms
📦 What is this software?
Semcms by Sem Cms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of admin credentials, user data, and content; potential for data destruction or website defacement.
Likely Case
Unauthorized data extraction from the CMS database, potentially exposing user information, content, and configuration details.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Public proof-of-concept available on GitHub; SQL injection via URL parameter makes exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check vendor website for updates; if unavailable, implement workarounds or consider migrating to alternative CMS.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the pid parameter before processing
Modify SEMCMS_ct.php to add: $pid = intval($_GET['pid']);
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL keywords in pid parameter
🧯 If You Can't Patch
- Restrict access to SEMCMS_ct.php using IP whitelisting or authentication
- Implement database-level protections: Use least privilege accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Test by appending SQL injection payloads to pid parameter: /SEMCMS_ct.php?pid=1' OR '1'='1Check Version:
Check CMS version in admin panel or readme filesVerify Fix Applied:
Test with same payloads; successful fix should return error or no data instead of executing SQL📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web logs
- Multiple requests with SQL keywords in pid parameter
- Long or malformed pid parameter values
Network Indicators:
- HTTP requests containing SQL injection patterns in URL parameters
- Unusual database query patterns from web server
SIEM Query:
web.url:*pid=* AND (web.url:*OR* OR web.url:*UNION* OR web.url:*SELECT* OR web.url:*--*)