PT-2023-28721 · Macrob7 · Macrob7 Macs Framework Content Management System

Ally Petitt · Published 2023-09-26 · Updated 2023-10-02 · CVE-2023-43154

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Macrob7 Macs Framework Content Management System (CMS) version 1.1.4f

Description The issue is related to a PHP type confusion vulnerability due to loose comparison in the isValidLogin() function during a login attempt. This vulnerability can lead to authentication bypass and takeover of the administrator account.

Recommendations For Macrob7 Macs Framework Content Management System (CMS) version 1.1.4f, consider disabling the isValidLogin() function until a patch is available to prevent potential exploitation. Restrict access to the login functionality to minimize the risk of authentication bypass.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2023-43154

Affected Products

Macrob7 Macs Framework Content Management System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-43154 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43154 · Vendor Advisory
• https://cxsecurity.com/issue/WLB-2023090075 · Note
• https://twitter.com/CVEnew/status/1706770244440834380 · Twitter Post
• https://github.com/ally-petitt/macs-cms-auth-bypass · Note