{"api_version":"1","generated_at":"2026-07-23T20:47:01+00:00","cve":"CVE-2023-43154","urls":{"html":"https://cve.report/CVE-2023-43154","api":"https://cve.report/api/cve/CVE-2023-43154.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-43154","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-43154"},"summary":{"title":"CVE-2023-43154","description":"In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in \"isValidLogin()\" function during login attempt results in PHP type confusion vulnerability that leads to authentication bypass and takeover of the administrator account.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2023-09-27 15:19:00","updated_at":"2023-10-02 16:51:00"},"problem_types":["CWE-843"],"metrics":[],"references":[{"url":"https://cxsecurity.com/issue/WLB-2023090075","name":"https://cxsecurity.com/issue/WLB-2023090075","refsource":"MISC","tags":[],"title":"PHP Type Confusion Vulnerability Leading to Administrator Account Takeover via Authentication Bypass - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/ally-petitt/macs-cms-auth-bypass","name":"https://github.com/ally-petitt/macs-cms-auth-bypass","refsource":"MISC","tags":[],"title":"GitHub - ally-petitt/CVE-2023-43154-PoC: PoC for the type confusion vulnerability in Mac's CMS that results in authentication bypass and administrator account takeover.","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43154","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43154","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"43154","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"macs_cms_project","cpe5":"macs_cms","cpe6":"1.1.4f","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2023-43154","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in \"isValidLogin()\" function during login attempt results in PHP type confusion vulnerability that leads to authentication bypass and takeover of the administrator account."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://github.com/ally-petitt/macs-cms-auth-bypass","refsource":"MISC","name":"https://github.com/ally-petitt/macs-cms-auth-bypass"},{"refsource":"MISC","name":"https://cxsecurity.com/issue/WLB-2023090075","url":"https://cxsecurity.com/issue/WLB-2023090075"}]}},"nvd":{"publishedDate":"2023-09-27 15:19:00","lastModifiedDate":"2023-10-02 16:51:00","problem_types":["CWE-843"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:macs_cms_project:macs_cms:1.1.4f:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}