CVE-2023-37647

CriticalCVSS 9.8

Published: 31/07/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

40th percentile - higher than 40% of all known CVEs

Summary

SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the 'id' parameter in /Ant_Suxin.php. An attacker can manipulate this parameter to execute unauthorized database queries.

Risk Assessment

The risk involves potential theft, modification, or deletion of database data, leading to breaches of confidentiality and integrity, and possible system takeover.

Recommendation

Immediately update SEMCMS to the latest version and implement input validation and parameterized SQL queries for the 'id' parameter.

Original NVD description (English source)

SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.