Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page
Priority MEDIUM 48CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thedigicraft | Atom CMS | 2.0 | — | No fix listed | CNA |
- Atom CMS Vendorthedigicraft Affected 2.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Thedigitalcraft |
- cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Thedigitalcraft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-53975
- 2026-10-03 Alias added: GHSA-c2r6-r382-m667
References
Exploit 1
Other 1
More Thedigitalcraft Atomcms vulnerabilities
- TI-2022-08132 AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. CVSS 3.1CRITICAL 9.8
- TI-2022-09128 Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. CVSS 3.1CRITICAL 9.8
- TI-2022-09129 Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php. CVSS 3.1CRITICAL 9.8
- TI-2022-10867 AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php CVSS 3.1CRITICAL 9.8
- TI-2022-10868 Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php CVSS 3.1CRITICAL 9.8
- TI-2022-10871 AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_navigation.php CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-53975 · CVE Program
- CVE-2023-53975 · NVD
- FIRST EPSS
- GHSA-c2r6-r382-m667 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences