TI-2023-24362 Aliases CVE-2023-45503 GHSA-9cxq-hmh9-xh96

SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to…

LOW 32CWE-89Published 2024-04-15 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via crafted payload to resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole, deleteComment, deleteUser, allowComment, saveRole, forgotPasswordProcess, resetPassword, saveUser, addComment, saveRole, and saveUser endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00914 60th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:macs_cms_project:macs_cms:1.1.4f:::::::*	1.1.4f	Vulnerable	Macs Cms Project

cpe:2.3:a:macs_cms_project:macs_cms:1.1.4f:*:*:*:*:*:*:* Versions 1.1.4f Vulnerable ·Macs Cms Project

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-45503
2026-10-03 Alias added: GHSA-9cxq-hmh9-xh96

References

Exploit 1

https://github.com/ally-petitt/CVE-2023-45503?tab=readme-ov-file

Other 1

https://docs.google.com/spreadsheets/d/1AzXspN8oBAJ80YQxfN44bpbOuNzA3PZEccQ6IGQMs5E/edit?usp=sharing

TI-2023-23120 In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in… CVSS 3.1CRITICAL 9.8
TI-2020-14441 Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL… CVSS 3.1HIGH 7.2
TI-2020-14443 Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences