CVE-2023-48864 is a high severity (CVSS 7.5) SQL injection flaw in SEMCMS 4.8, a content management system for multilingual trade websites. The languageID parameter in web_inc.php reaches a database query. We could not confirm a fixed version, so limit exposure and check with the vendor.
What's affected
- SEMCMS version 4.8, per the NVD record. The record lists no other versions.
- The write-up referenced by the record, hosted on Gitee, says the flaw is in web_inc.php and that an attacker with no credentials can run unintended SQL commands to read data.
- Fixed version: none confirmed. The record has no vendor advisory, so check the SEMCMS site and release notes.
- The vector shows high confidentiality impact only, with no effect on integrity or availability.
- Severity: the record gives CVSS 7.5, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity none and on availability none. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Look at the version of SEMCMS in your installation. The version number is normally shown in the admin panel or in the downloaded package name. Version 4.8 is the one named in the record.
Then look at where the site is reachable and what is behind it. Check the database account the CMS uses, and whether it can read tables that have nothing to do with the website, such as user records or other applications.
Also look at your web server logs for unusual requests to web_inc.php with odd values for languageID.
What to do now
- Check the vendor site for a release newer than 4.8 and read its notes for this issue.
- Put a web application firewall in front of the site and enable rules for SQL injection.
- Reduce the database account to the minimum rights the CMS needs.
- Back up the database and test restores, in case you need to rebuild.
- Plan a move to a maintained CMS if the vendor does not publish a fix.
Why it matters
The class is CWE-89 (SQL Injection). According to the write-up, the code passes the languageID value through filtering that relies on a blocklist, then places it into a database query. Blocklists tend to miss cases, because there are many ways to write the same instruction. The reliable fix is to use parameterised queries so the value can never be read as part of the query.
With no credentials needed and a network reachable site, this is the kind of flaw that automated scanners find easily. The impact in the record is limited to reading data, but a database often holds password hashes and customer details.
Quick check
Is there an official patch?
We could not confirm one. The record links only a third party write-up, so ask the vendor and watch for a new release.
What is the quickest mitigation?
Limit who can reach the site, add WAF rules for SQL injection, and reduce database privileges while you wait for a fix.
Sources
Last reviewed: 19 October 2026.
