SEMCMS SQL Injection Vulnerability (CNVD-2024-06232)

2024-01-1200:00:00

China National Vulnerability Database

www.cnvd.org.cn

semcms

sql injection

v4.8

sensitive data

web content management

language parameter

8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

31.9%

JSON

SEMCMS is a foreign trade web content management system (CMS) that supports multiple languages. A SQL injection vulnerability exists in SEMCMS v4.8, which originates from the lack of validation of externally entered SQL statements via the languageID parameter in /web_inc.php. The vulnerability can be exploited by an attacker to execute illegal SQL commands to steal sensitive database data.

CPENameOperatorVersion
semcms semcms veq4.8

CPE	Name	Operator	Version
	semcms semcms v	eq	4.8