SEMCMS CVE-2026-108813

Exploitation targets the SEMCMS_Download.php endpoint specifically, where a user-controlled parameter is manipulated and passed unsanitized into a SQL query. Per the only available CVSS data (PR:L), a low-privileged authenticated session is required, which limits exposure to attackers who can reach and log into the application; however, this authentication requirement is taken from the vector alone and is not confirmed by a vendor advisory, so whether SEMCMS_Download.php is actually gated behind authentication should be verified. All versions of SEMCMS up to and including 5.0 are reportedly affected, and no patch is available because the vendor did not respond to the disclosure.

This is a SQL injection flaw (CWE-89) in SEMCMS's SEMCMS_Download.php, reachable over the network with low privileges per the sole CVSS signal provided (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N, impacts VC:L/VI:L/VA:L). The vendor-assigned CVSS 4.0 base score of 2.1 is unusually low for an SQLi, driven by the Low confidentiality/integrity/availability ratings and the PR:L requirement - real-world SQLi often yields fuller database read/write, so the Low impact scoring may understate actual risk; verify the injection's reach before deprioritizing. POC availability is CONFIRMED (public exploit on GitHub, E:P in the vector), but there is NO CISA KEV listing and NO EPSS score in the input, so publicly available exploit code exists without evidence of active or widespread exploitation. The source is VulDB (a single CNA/aggregator), the product is niche, and the vendor was non-responsive with no patch, meaning exposed instances stay vulnerable. Net: a credible, real but modest-priority issue - exploit code lowers the bar, yet low deployment footprint, the PR:L authentication requirement, and absence of KEV/EPSS argue against emergency treatment. Note the conflict: a public exploit against an unpatched product normally raises urgency, while the vendor's own Low-impact CVSS pulls it down.

An attacker with low-level authenticated access to a SEMCMS site sends a crafted request to SEMCMS_Download.php containing a malicious SQL payload in a manipulated parameter, which the application concatenates into a database query. Because a public proof-of-concept already exists (GitHub, ants01), the attacker can reuse it directly to extract or tamper with database contents. The CVSS vector indicates network reach and low attack complexity, so the request requires no special timing or local access.