CVE-2025-25686

semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php

Critical · published March 27, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
42.9
In the wild
Unconfirmed
What it is

🚨 A single SQL injection vulnerability in semcms versions up to 5.0 could be the key for an attacker to waltz right into your database! 🔥 Imagine a restaurant that leaves the back door wide open, allowing anyone to stroll in and tamper with the menu or even the cash register. This SQL injection flaw works much the same way, letting attackers manipulate your database with just a sneaky input! An attacker can execute arbitrary SQL commands, allowing them to read sensitive data, modify records, or even delete everything in sight. This could lead to total chaos, exposing confidential information that could be absolutely devastating for your organization! 🚨

Put simply

Imagine a restaurant that leaves the back door wide open, allowing anyone to stroll in and tamper with the menu or even the cash register. This SQL injection flaw works much the same way, letting attackers manipulate your database with just a sneaky input! The SQL injection vulnerability in SEMCMS_Fuction.php allows attackers to inject harmful SQL queries into the application, exploiting improper input validation.

What to do

An attacker can execute arbitrary SQL commands, allowing them to read sensitive data, modify records, or even delete everything in sight. This could lead to total chaos, exposing confidential information that could be absolutely devastating for your organization! 🚨 Immediate action is critical! Upgrade to SEMCMS version 5.0.1 or higher to patch this vulnerability. Additionally, implement prepared statements to safeguard against future SQL injection attacks. You’ve got this! With these steps, you’ll secure your application and be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00514 · 42.9th percentile
Published
2025-03-27T00:00Z
EPSS history
Timeline
  • 27 MAR 00:00Z
    semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php
    cvelistv5