CVE-2024-31009

Name of the Vulnerable Software and Affected Versions SEMCMS version 4.8

Description The issue allows a remote attacker to obtain sensitive information via the lgid parameter in Banner.php. This is a result of a SQL injection vulnerability.

Recommendations For SEMCMS version 4.8, consider restricting access to the Banner.php file or the lgid parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the lgid parameter in the affected API endpoint until the issue is resolved.