An SQL injection flaw exists in the SEMCMS application in an undeclared function of the SEMCMS_Banner.php file. By supplying crafted input, an attacker can manipulate SQL statements executed against the database, potentially retrieving, modifying, or deleting data. The vulnerability can be triggered remotely and has been publicly disclosed and demonstrated, indicating that exploitation is realistic and not purely theoretical.

Vendors: SEMCMS. Affected products include SEMCMS up to and including version 5.0. The description does not specify patch status beyond the statement that the vendor has not responded to early disclosure. No other version information is provided.

The CVSS score of 5.3 indicates moderate severity, while no EPSS score is available, so the exact likelihood of exploitation is unknown. The exploit is publicly available, and the attack can be launched remotely, implying a realistic threat. The vulnerability is not yet listed in the CISA KEV catalog.