CVE-2025-25686
Published: 27 March 2025
Summary
CVE-2025-25686 is a critical-severity SQL Injection (CWE-89) vulnerability in Sem-Cms Semcms. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25686 is a SQL injection vulnerability (CWE-89) in SEMCMS versions 5.0 and earlier, specifically within the SEMCMS_Fuction.php component. Published on 2025-03-27T16:15:29.987, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables arbitrary SQL query execution, granting high-impact access to confidentiality (data disclosure), integrity (data modification), and availability (data deletion or denial of service) of the affected database.
Mitigation details are available in the referenced advisory at https://github.com/J1095/fkapfxx.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8647
Vulnerability details
semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a web-facing CMS (semcms) enables exploitation of public-facing applications (T1190) and facilitates unauthorized access to databases for data collection (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires information input validation that directly prevents SQL injection by sanitizing user inputs before execution in database queries within SEMCMS_Fuction.php.
SI-2 mandates flaw remediation, ensuring timely patching or updating of the vulnerable SEMCMS <=5.0 to eliminate the SQL injection vulnerability.
SI-9 enforces information input restrictions that limit the types and formats of inputs, blocking common SQL injection payloads targeting the unauthenticated endpoint.