CVE-2026-1552
📋 TL;DR
This SQL injection vulnerability in SEMCMS 5.0 allows attackers to manipulate database queries through the searchml parameter in /SEMCMS_Info.php. Attackers can potentially read, modify, or delete database content remotely. All SEMCMS 5.0 installations with the vulnerable file accessible are affected.
💻 Affected Systems
- SEMCMS
📦 What is this software?
Semcms by Sem Cms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data extraction from the database, potentially exposing sensitive information like user credentials or business data.
If Mitigated
Limited impact with proper input validation and database permissions restricting query execution.
🎯 Exploit Status
Public exploit available on GitHub. Remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the searchml parameter before processing.
Edit /SEMCMS_Info.php to add parameter validation using prepared statements or escaping functions.
File Access Restriction
allRestrict access to the vulnerable file using web server configuration.
For Apache: Add 'Deny from all' to .htaccess in the directory containing SEMCMS_Info.php
For Nginx: Add 'location ~ /SEMCMS_Info.php { deny all; }' to server block
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns targeting searchml parameter.
- Restrict database user permissions to read-only for the application account.
🔍 How to Verify
Check if Vulnerable:
Check if /SEMCMS_Info.php exists and contains unsanitized searchml parameter handling. Test with SQL injection payloads like ' OR '1'='1 in searchml parameter.Check Version:
Check SEMCMS version in configuration files or admin panel. Look for version 5.0 indicators.Verify Fix Applied:
Test with SQL injection payloads after implementing fixes. Verify no database errors or unexpected results occur.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries in application logs
- SQL syntax errors in web server logs
- Multiple requests to /SEMCMS_Info.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in searchml parameter
- Unusual traffic patterns to vulnerable endpoint
SIEM Query:
web.url:*SEMCMS_Info.php* AND (web.param.searchml:*SELECT* OR web.param.searchml:*UNION* OR web.param.searchml:*OR*)