SEMCMS version 5.0 contains an input validation flaw in the searchml argument of the SEMCMS_Info.php script. Attackers can supply crafted input that is not properly escaped, allowing arbitrary SQL statements to be injected into the backend database query. This flaw can be triggered remotely through the web interface, allowing an attacker to read, modify, or delete data stored in the database, potentially leading to data exposure or integrity compromise. The CVSS score of 5.3 reflects moderate severity, with the potential to impact confidentiality and integrity of database contents.

The vulnerability is specific to the SEMCMS content management system, version 5.0, which is the only version identified by the CNA. The affected code resides in the /SEMCMS_Info.php file and is exercised by the searchml parameter. No other vendors or product lines are listed. If any other implementations use the same code base, they may also be impacted.

The exploit is publicly available on GitHub and other vulnerability databases, and can be achieved over the network by providing a malicious searchml value to the web application. The EPSS score of <1% indicates that the probability of exploitation in the wild is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, since the flaw can be triggered via the exposed web interface, organizations that publicly host the CMS should treat the risk as moderate and consider the existing exploit in their threat model. The lack of an official patch emphasizes the need for immediate mitigation actions.