CVE-2026-108813: SQL Injection in SEMCMS

This vulnerability affects SEMCMS version 5.0 and involves a SQL injection flaw in an unspecified function of the SEMCMS_Download.php file. Remote attackers can exploit this flaw without user interaction or elevated privileges to manipulate SQL queries, potentially compromising the database. The exploit is publicly known, but no official patch or remediation has been provided by the vendor, who has not responded to disclosure efforts.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. However, the overall impact is rated medium due to limited details on the exact consequences and the lack of confirmed active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor for official updates. In the meantime, consider applying web application firewall rules to detect and block SQL injection attempts targeting SEMCMS_Download.php and restrict access to this script if possible.