External risk intelligence

SEM-PMP SQL Injection Vulnerability Allows Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-5801

SEM-PMP is a privileged management platform or enterprise software solution. Such products are commonly deployed as web-based interfaces or management portals that are often exposed to network environments to facilitate administrative access, making them a common target for internet-reachable deployment patterns.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the SEM-PMP software, which could allow for command execution through SQL injection. This means an attacker could potentially run unauthorized commands on affected systems if they can access the software remotely. The primary concern is to determine if your organization uses this specific software and, if so, to confirm its exposure and potential impact.

Attackers can run commands remotely.
It's a critical flaw impacting business operations.
Confirm use and exposure of SEM-PMP.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted commands over the network to the SEM-PMP product. Because the software improperly handles special characters in SQL commands, the attacker can trick the system into executing arbitrary commands. This could allow an attacker to take control of the affected system.

Network exposure required.
SQL injection via crafted commands.
Command execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

The SQL injection vulnerability in SEM-PMP could allow an unauthenticated attacker to execute arbitrary commands on the system by sending specially crafted SQL queries. This could potentially lead to the compromise of the system's integrity and confidentiality.

System commands and data at risk.
Remote SQL injection to execute commands.
Unauthenticated command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP requires an immediate inventory of all SEM-PMP installations to assess exposure. The platform owner or the team managing the application infrastructure should lead the effort to confirm business criticality and network reachability, followed by coordinated remediation planning.

Identify SEM-PMP instances and ownership.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SEM-PMP and how is it used?

SEM-PMP, developed by Semtek Informatics Software Consulting, is a privileged management platform. Organizations typically use this type of enterprise software as a centralized web-based interface or portal to manage sensitive administrative access and internal systems.

What does SQL injection mean for CVE-2026-5801?

This vulnerability is classified as CWE-89, which occurs when software fails to properly filter special characters in database queries. In the context of CVE-2026-5801, this weakness allows an attacker to manipulate SQL commands to bypass security controls and force the underlying system to execute unauthorized command-line instructions.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted SQL queries to the SEM-PMP application over the network. It does not require user interaction or prior authentication. Simply sending standard, legitimate queries to the software will not trigger the bug; the input must be specifically engineered to escape the application's intended logic and force command execution.

Do I need to worry if my SEM-PMP instance is internal?

Halo Surface Signal indicates that SEM-PMP is often deployed as a web-accessible management portal. While any instance is potentially vulnerable, the risk is highest for installations reachable from the internet. You should determine if your specific deployment allows network access from outside your corporate boundary, as internet-facing instances are the primary concern for this type of network-based attack.

How should I respond if I use SEM-PMP?

Start by conducting a thorough inventory to locate all instances of SEM-PMP within your infrastructure. Identify which team manages the application and verify its network reachability. Once you have a clear picture of your environment, coordinate with your technical teams to assess the business impact and prepare for necessary updates or configuration changes to mitigate the risk of remote command execution.

References

siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0527

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.