PT-2023-26058 · Semcms · Semcms

Published 2023-07-31 · Updated 2023-08-04 · CVE-2023-37647

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SEMCMS version 1.5

Description The issue is a SQL injection vulnerability. It can be exploited via the id parameter at the "/Ant Suxin.php" API endpoint.

Recommendations For SEMCMS version 1.5, as a temporary workaround, consider restricting access to the "/Ant Suxin.php" endpoint until a patch is available. Avoid using the id parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-37647

Affected Products

Semcms

References · 7

• https://osv.dev/vulnerability/CVE-2023-37647 · Vendor Advisory
• https://sem-cms.cn · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37647 · Security Note
• https://gitee.com/ants12/sem-cms_-shop_210918_v1.5-sql-injection-exists-s/tree/master · Note
• https://t.me/cvenotify/55558 · Telegram Post
• https://t.me/cibsecurity/67450 · Telegram Post
• http://semcms.com · Note