{"id":"CVE-2023-45503","aliases":["EUVD-2023-49795","GHSA-9cxq-hmh9-xh96"],"status":"published","title":"SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute...","description":"SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via crafted payload to resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole, deleteComment, deleteUser, allowComment, saveRole, forgotPasswordProcess, resetPassword, saveUser, addComment, saveRole, and saveUser endpoints.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00914,"percentile":0.60358,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2024-04-15T00:00:00Z","modified":"2026-06-17T06:28:47Z","exploits":[{"source":"pocgithub","id":"ally-petitt/CVE-2023-45503","title":"ally-petitt/CVE-2023-45503","date":"2024-04-07","url":"https://github.com/ally-petitt/CVE-2023-45503"}],"products":[{"vendor":"macrob7_macs_framework_content_management_system_project","product":"macrob7_macs_framework_content_management_system"},{"vendor":"macs_cms_project","product":"macs_cms"}],"references":[{"url":"https://docs.google.com/spreadsheets/d/1AzXspN8oBAJ80YQxfN44bpbOuNzA3PZEccQ6IGQMs5E/edit?usp=sharing","tags":["x_transferred","Not Applicable"]},{"url":"https://github.com/ally-petitt/CVE-2023-45503?tab=readme-ov-file","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45503"},{"url":"https://github.com/advisories/GHSA-9cxq-hmh9-xh96"}],"sources":{"cve":[{"id":"CVE-2023-45503","description":"SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via crafted payload to resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole, deleteComment, deleteUser, allowComment, saveRole, forgotPasswordProcess, resetPassword, saveUser, addComment, saveRole, and saveUser endpoints.","status":"published","published":"2024-04-15T00:00:00Z","modified":"2024-08-02T20:21:16.541Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-49795","description":"SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via crafted payload to resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole, deleteComment, deleteUser, allowComment, saveRole, forgotPasswordProcess, resetPassword, saveUser, addComment, saveRole, and saveUser endpoints.","status":"published","published":"2024-04-15T00:00:00Z","modified":"2024-08-02T20:21:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:49:58.963788Z"}],"ghsa":[{"id":"GHSA-9cxq-hmh9-xh96","title":"SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute...","description":"SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via crafted payload to resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole, deleteComment, deleteUser, allowComment, saveRole, forgotPasswordProcess, resetPassword, saveUser, addComment, saveRole, and saveUser endpoints.","status":"published","published":"2024-04-15T21:30:46Z","modified":"2024-08-01T15:32:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:57:48.13007Z"}],"nvd":[{"id":"CVE-2023-45503","description":"SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via crafted payload to resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole, deleteComment, deleteUser, allowComment, saveRole, forgotPasswordProcess, resetPassword, saveUser, addComment, saveRole, and saveUser endpoints.","status":"published","published":"2024-04-15T20:15:10.777Z","modified":"2026-06-17T06:28:47.813Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:09:11.362739Z"}]}}