CVE-2025-51655
📋 TL;DR
SemCms v5.0 contains a SQL injection vulnerability in the SEMCMS_Quanxian.php file via the pid parameter. This allows attackers to execute arbitrary SQL commands on the database. All users running SemCms v5.0 are affected.
💻 Affected Systems
- SemCms
📦 What is this software?
Semcms by Sem Cms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential authentication bypass leading to administrative access.
Likely Case
Data extraction from the database, including user credentials, sensitive content, or configuration data.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented; database permissions restrict damage.
🎯 Exploit Status
Public proof-of-concept exists on GitHub; SQL injection via URL parameter is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://semcms.com
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and apply. 3. Replace vulnerable SEMCMS_Quanxian.php file. 4. Test functionality after update.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize pid parameter before processing
// In SEMCMS_Quanxian.php, add: $pid = intval($_GET['pid']);
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Implement network segmentation to restrict access to SemCms instance
- Deploy database monitoring to detect SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test by accessing SEMCMS_Quanxian.php with malicious pid parameter (e.g., pid=1' OR '1'='1)Check Version:
Check SemCms version in admin panel or configuration filesVerify Fix Applied:
Test same payload after fix; should return error or no database interaction📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to SEMCMS_Quanxian.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords in pid parameter
- Abnormal database query patterns
SIEM Query:
source="web_logs" AND uri="*SEMCMS_Quanxian.php*" AND (query="*pid=*'*" OR query="*pid=*%27*")