CVE-2023-48863

Products: SEMCMS PHP

Vulnerability type: Time blind injection

Vulnerability hazard: Sensitive database information can be obtained

Details

At Site background directory SQL Injection exists for the ID paramter in SEMCMS_InquiryView.php,which is scanned and replicated using this project python script.

Usage:

python poc.py url "cookie"

example:

python poc.py http://www.xxx.com/bJRbbi_Admin/SEMCMS_InquiryView.php "scusername=%E6%80%BB%E8%B4%A6%E5%8F%B7; scuseradmin=Admin; scuserpass=c4ca4238a0b923820dcc509a6f75849b"