CVE-2026-5801: SEM-PMP SQL Injection Vulnerability

CVE-2026-5801 Overview

CVE-2026-5801 is a SQL injection vulnerability affecting Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP. The flaw allows unauthenticated attackers to execute operating system commands through injected SQL statements. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

The issue affects all SEM-PMP versions through build 23042026. The Turkish national cyber security authority published advisory TR-26-0527 covering this disclosure.

Critical Impact
Remote attackers can execute arbitrary operating system commands without authentication, resulting in full compromise of the SEM-PMP host.

Affected Products

Semtek SEM-PMP versions through 23042026
Deployments exposing the SEM-PMP web interface to untrusted networks
Backend database servers reachable from the SEM-PMP application tier

Discovery Timeline

2026-07-10 - CVE-2026-5801 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-5801

Vulnerability Analysis

SEM-PMP fails to neutralize special characters in SQL statements built from user-supplied input. Attackers submit crafted parameters that break out of the intended query context and append attacker-controlled SQL. The advisory categorizes the resulting impact as Command Line Execution through SQL Injection, meaning the injection chain reaches operating system command execution primitives exposed by the database engine.

The vulnerability is reachable over the network without authentication or user interaction. A single HTTP request carrying a malicious payload is sufficient to compromise confidentiality, integrity, and availability of the target system.

Root Cause

The root cause is the concatenation of untrusted input into SQL statements without parameterized queries or input validation. SEM-PMP passes request parameters directly into query strings executed by the backend database. Because the database service is configured to permit command execution features such as xp_cmdshell or equivalent stored procedures, injected SQL escalates from data disclosure to arbitrary command execution on the underlying host.

Attack Vector

An unauthenticated attacker sends a specially crafted request to a vulnerable SEM-PMP endpoint. The injected SQL payload closes the original query, appends command execution syntax, and instructs the database engine to spawn a shell. Because the application does not sanitize inputs and the database runs with elevated privileges, commands execute in the security context of the database service account. The advisory does not indicate authentication is required, and the attack complexity is low.

No verified public exploit code is available at this time. Technical details are described in the Siber Güvenlik advisory TR-26-0527.

Detection Methods for CVE-2026-5801

Indicators of Compromise

Web server logs containing SQL meta-characters such as ', --, ;, UNION, EXEC, or xp_cmdshell in request parameters targeting SEM-PMP endpoints
Database process spawning shell interpreters (cmd.exe, powershell.exe, /bin/sh) as child processes
Outbound connections initiated by the database service to unexpected external hosts
New scheduled tasks, services, or accounts created by the database service account

Detection Strategies

Deploy web application firewall rules that identify SQL injection payloads in requests to SEM-PMP
Correlate database service process lineage with command execution telemetry from endpoint agents
Baseline normal SEM-PMP query patterns and alert on statements invoking system stored procedures

Monitoring Recommendations

Enable verbose logging on the database engine and forward events to a centralized SIEM
Monitor for anomalous authentication events and privilege changes on the SEM-PMP host
Track network flows from the SEM-PMP application and database tiers for unexpected egress traffic

How to Mitigate CVE-2026-5801

Immediate Actions Required

Restrict network access to the SEM-PMP web interface using firewall rules or VPN gating
Disable database command execution features such as xp_cmdshell where they are not required
Rotate credentials used by the SEM-PMP application and its database service account
Contact Semtek to confirm patch availability and apply fixed builds beyond 23042026

Patch Information

The advisory identifies SEM-PMP through build 23042026 as affected. Administrators should consult Semtek directly and reference the Siber Güvenlik advisory TR-26-0527 for the current fixed version. Apply vendor patches promptly and verify that the deployed build supersedes the vulnerable range.

Workarounds

Deploy a web application firewall with SQL injection signatures in front of SEM-PMP
Run the database service under a least-privilege account that cannot spawn OS commands
Segment the SEM-PMP database from broader corporate networks to limit lateral movement
Enforce parameterized query proxies or database activity monitoring where available

bash

# Example: disable xp_cmdshell on Microsoft SQL Server backends
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;