External risk intelligence

SEMCMS 1.5 SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-37647

SEMCMS is a content management system designed to host websites. Such applications are typically deployed as internet-facing web services to manage site content, making the underlying web application endpoints, including the identified vulnerable file, commonly reachable from the public internet in standard deployments.

SQL Injection

Sem Cms Semcms

1.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SEMCMS, a content management system, that could allow unauthorized access and modification of data. This issue exists in the /Ant_Suxin.php file and impacts version 1.5. The potential for broad impact stems from the system's typical deployment as an internet-facing web service.

Flaw allows unauthorized data access and changes.
Critical issue affects public-facing websites.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the affected web application. This request targets a specific parameter within the application's code, which then improperly handles the input, leading to a SQL injection. The vulnerability can result in significant data compromise and unauthorized actions.

No authentication required.
Vulnerable parameter in web script.
Database access and modification.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the id parameter of /Ant_Suxin.php could allow unauthenticated attackers to manipulate database queries when SEMCMS is deployed as a public-facing website.

Database integrity and availability.
Malicious SQL commands sent via HTTP.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SEMCMS product, specifically version 1.5, is vulnerable to SQL injection. Given that SEMCMS is a content management system designed for websites, it's likely deployed as an internet-facing service. Therefore, application owners or infrastructure teams responsible for web services should prioritize identifying all instances of SEMCMS, assessing their reachability and business criticality, and confirming the accountable owner for remediation planning.

Application or infrastructure owners
Verify SEMCMS deployment reachability
Plan remediation based on risk

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SEMCMS?

SEMCMS is a content management system (CMS) designed to help users build and maintain websites. It provides the infrastructure to manage digital content and typically serves as the engine that powers a site's front-end display and back-end database interactions.

How does SQL injection work in CVE-2023-37647?

This vulnerability is classified as CWE-89, or improper neutralization of special elements used in an SQL command. In this specific case, the application fails to safely process user-supplied input in the 'id' parameter of the Ant_Suxin.php file. This allows an attacker to inject their own malicious database commands, which the system then executes, potentially granting unauthorized access to or control over the underlying database.

Do I need to be logged in to trigger this vulnerability?

No. The flaw does not require any authentication to trigger. An attacker can initiate the attack remotely by sending a specifically crafted HTTP request to the target script. Simple, legitimate interactions that do not involve passing malicious data to the id parameter will not trigger the vulnerability.

Why is this CVE considered an external risk?

According to Halo Surface Signal, SEMCMS is typically deployed as an internet-facing web service to function as a website. Because the vulnerable file is part of the web application structure, it is commonly reachable from the public internet. This exposure increases the likelihood that an attacker can interact with the vulnerable parameter from outside your network.

What should I do if I am running SEMCMS 1.5?

You should prioritize identifying all instances of SEMCMS within your environment to determine which are active. Once identified, assess the reachability of these systems and determine their business criticality. Coordinate with the responsible system owners to plan for remediation steps, such as applying patches or updates if available, or restricting access to the affected script until the issue can be resolved.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.