by Kastro
Paper/Archive/CVE-2023-53975

CVE-2023-53975

thedigicraft Atom CMS — Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 40.8.408 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks.

Affected

ProductAffectedFixed inSource
Atom CMS2.0–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
VulnCheck (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/51086refgithub.com/thedigicraft/Atom.CMSwriteupvulncheck.com/advisories/atom-cms-unauthenticated-sql-injection-via-admin-index-page