Compliance Impact

The vulnerability in SEMCMS 5.0 allows unauthenticated users to export a complete SQL database backup containing sensitive data such as administrator credentials, user information, and website configurations. This exposure of sensitive personal and administrative data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to and protection of personal and confidential information.

Specifically, unauthorized access to sensitive data increases the risk of data breaches, which can result in legal penalties, loss of trust, and other compliance issues under these regulations.

Useful 0 Not Useful 0

Executive Summary

SEMCMS 5.0 and earlier versions have a vulnerability in the administrative backup component (SEMCMS_copy.php) that allows unauthorized users to export the database without authentication.

This happens because of improper access control, enabling anyone to send a specially crafted request to the backup module and trigger a full SQL database backup.

The backup file is saved in a predictable location (/backups/semcms.sql) and can be downloaded, exposing sensitive data such as administrator credentials, user information, and website configurations.

Additionally, a syntax error in the backup script may disrupt the backup process until fixed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information stored in the SEMCMS database.

• Exposure of administrator credentials, which could allow attackers to gain full control over the system.
• Leakage of user data and confidential website configurations.
• Potential compromise of the entire website or system due to leaked sensitive information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the SEMCMS_copy.php backup module is accessible without authentication and if it allows triggering a database export.

A simple way to test this is to send an HTTP request to the backup script with the specific parameter that triggers the export.

• Use a command like: curl -I http://<your_server>/<admin_path>/SEMCMS_copy.php?type=dc
• If the response indicates the backup file is generated or accessible, the vulnerability exists.
• Additionally, check if the backup file exists at /backups/semcms.sql on the server.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to SEMCMS_copy.php to authorized administrators only.

• Enforce administrator authentication before allowing access to the backup module.
• Disable direct access to backup files by moving them outside the web root directory.
• Fix the syntax error in SEMCMS_copy.php (specifically the incorrect if statement) to ensure proper functioning of the backup process.

Useful 0 Not Useful 0