Blind SQL Injection Vulnerability in CUSG CMS Before v.7.75 Allows Remote Attacker to Execute Arbitrary Code and Obtain Sensitive Information

CVE-2023-48987

What is CVE-2023-48987?

A Blind SQL Injection vulnerability exists in the CU Solutions Group Content Management System (CMS) prior to version 7.75. This flaw allows a remote attacker to exploit the pages.php component using specially crafted scripts. By manipulating input parameters, an attacker can execute arbitrary SQL queries against the database, potentially leading to unauthorized access, privilege escalation, and exposure of sensitive data. Organizations utilizing affected versions of the CMS are strongly advised to assess their systems and deploy necessary patches to mitigate the risks associated with this vulnerability.

References