CVE-2023-48987 is a high severity (CVSS 7.5) blind SQL injection flaw in the CU Solutions Group content management system before version 7.75, found in pages.php. The researcher advises upgrading and turning on multi-factor authentication. The vendor says it pushed an update to all customers.
What's affected
- CU Solutions Group (CUSG) Content Management System before v7.75, per the NVD record.
- The LMG Security announcement of 13 February 2024 describes three vulnerabilities in this product, including this one in pages.php. It says organisations on versions before v7.75 should upgrade.
- Source conflict on access: the record's vector requires no privileges, while LMG describes this flaw as usable by an authenticated attacker. LMG chains it with a cross-site scripting flaw in the login page, CVE-2023-48985, in its scenario.
- LMG added an update stating that CUSG said it had already pushed an update to all users of its CMS that fixed all three issues.
- Severity: the record gives CVSS 7.5, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity none and on availability none. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
If you run this CMS, find the version in the admin portal and confirm it is v7.75 or later. If the vendor hosts the product for you, ask them to confirm in writing that the update has been applied to your instance.
Also check whether multi-factor authentication is on for the admin portal. LMG recommends it for all customers, whatever the version, because of a vendor level administrative account it describes.
Finally, review admin portal logs from before the update for unusual logins or odd behaviour.
What to do now
- Confirm your instance runs v7.75 or later, or ask CUSG to confirm.
- Enable multi-factor authentication on every admin portal account immediately.
- Review admin accounts and remove unneeded ones.
- Review logs and the database for signs of unauthorised access before the update.
- Include the CMS vendor in your third party risk review, with a question about how privileged vendor accounts are controlled.
Why it matters
The class is CWE-89 (SQL Injection), in its blind form. Blind SQL injection means the application does not show query results directly, but the attacker can still learn data by observing how the application behaves. It is slower to exploit than visible SQL injection, but it can still expose the whole database.
What stands out in the LMG account is the link between a single flaw and the whole customer base. LMG says a vendor level administrative account exists across installations, so one outdated installation could put others at risk. That is a supply chain lesson. A vulnerability in shared software is not only your problem, and multi-factor authentication is the control that limits the damage when a password leaks.
Quick check
Do I need to upgrade if the vendor hosts my site?
Ask the vendor to confirm it. CUSG told LMG it pushed an update to all CMS users, but you should get confirmation for your own instance.
Why does multi-factor authentication matter here?
LMG says that even if a vendor level password is obtained, multi-factor authentication stops it from being used to log in.
Sources
Last reviewed: 19 October 2026.
