PT-2023-30991 · Semcms · Semcms

Noblake · Published 2023-12-04 · Updated 2025-06-03 · CVE-2023-48863

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SEMCMS version 3.9

Description The issue is related to SQL Injection due to the lack of security checks on the input of the application. An attacker can inject malicious SQL commands into the background database engine for execution, sending attack codes as commands or query statements to the interpreter. These malicious data can deceive the interpreter, allowing the execution of unplanned commands or unauthorized access to data.

Recommendations For SEMCMS version 3.9, as a temporary workaround, consider implementing proper input validation and sanitization to prevent malicious SQL commands from being injected into the database engine. Restrict access to sensitive data and ensure that all user input is thoroughly checked to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-48863

Affected Products

Semcms

References · 9

• 🔥 https://gitee.com/NoBlake/cve-2023-48863 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48863 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48863 · Vendor Advisory
• https://t.me/cvenotify/62818 · Telegram Post
• https://t.me/cvenotify/62086 · Telegram Post
• https://twitter.com/CVEnew/status/1731669162894733793 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1731700933279515088 · Twitter Post
• http://sem-cms.com · Note
• https://t.me/cvenotify/124419 · Telegram Post