PT-2023-20796 · Mccms · Mccms

Nkingpp · Published 2023-04-28 · Updated 2025-01-31 · CVE-2023-26781

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mccms version 2.6

Description The issue allows remote attackers to run arbitrary SQL commands via the Author Center ->Reader Comments ->Search function. This can be exploited by accessing the Author Center and then navigating to Reader Comments and Search. The specific API endpoint involved is not clearly specified, but the vulnerability is related to SQL injection, which typically involves manipulating user input to execute unauthorized SQL code.

Recommendations For mccms version 2.6, consider restricting access to the Author Center ->Reader Comments ->Search function until a patch is available. As a temporary workaround, avoid using the search functionality in the Reader Comments section to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-26781

Affected Products

Mccms

References · 8

• 🔥 https://github.com/chshcms/mccms/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-26781 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26781 · Vendor Advisory
• https://t.me/cvenotify/49381 · Telegram Post
• https://t.me/cvenotify/49949 · Telegram Post
• https://t.me/cibsecurity/63094 · Telegram Post
• https://t.me/cvenotify/109477 · Telegram Post
• https://t.me/cvenotify/49361 · Telegram Post