PT-2019-12350 · Semcms · Semcms

Published 2019-04-25 · Updated 2019-04-27 · CVE-2019-11518

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SEMCMS version 3.8

Description An issue was discovered in SEMCMS, where the SEMCMS Inquiry.php file allows SQL Injection through the AID[] parameter because the inject check sql protection mechanism in the class.phpmailer.php file is incomplete.

Recommendations For SEMCMS version 3.8, consider disabling the SEMCMS Inquiry.php file or restricting access to it until a patch is available to prevent SQL Injection attacks. Avoid using the AID[] parameter in the affected file until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-11518

Affected Products

Semcms

References · 3

• 🔥❌ https://github.com/kikulo/DebugOpen/blob/master/SEMCMS3.8/main.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2019-11518 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11518 · Vendor Advisory