CVE-2024-0523 is a medium severity (6.3) SQL injection in CmsEasy. It affects CmsEasy up to version 7.7.7. The record names no fixed version and notes that the vendor did not respond to the researcher. Treat the product as exposed until you confirm the version and restrict who can reach it.
What's affected
- Product and location: CmsEasy up to version 7.7.7, in getslide_child_action in lib/admin/language_admin.php.
- The vulnerable parameter is sid.
- Fixed version: The record names no fixed version and notes that the vendor did not respond to the researcher.
- Severity: NVD scores it 6.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The disclosure text calls the issue critical, while the NVD score is medium. Both figures are shown so you can judge for yourself.
- Published: 2024-01-14.
- The record says the exploit has been disclosed to the public and may be used.
How to check if you're exposed
- Find the product on your servers. Look for the directory that holds the files named above, and read the version from the project files or the admin footer.
- Confirm whether the application is reachable from the internet with your reverse proxy or load balancer configuration.
- Check web server logs for unusual values in the parameter named in the Affected section, for example very long strings or SQL keywords.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Confirm whether you run the product and which version, using the checks above.
- Look for a vendor update. If none exists, assume the product stays unpatched.
- Use parameterized queries or a vetted query builder for every database call.
- Give the application a database account with only the permissions it needs.
- Review other endpoints in the same codebase for the same pattern.
- Run the free dependency scan at gold.safeguard.sh/scan on projects of yours that bundle similar components, and look the CVE up in the Gold directory.
Why it matters
The weakness is CWE-89, SQL injection. The application builds a database query using a request parameter without separating data from the query. Input meant to be a value can then change the meaning of the query.
The usual defence is parameterized queries, which keep user input out of the query text. Least privilege on the database account limits what a flaw can reach, and a web application firewall can reduce noise, though it is not a fix.
The record lists CWE-89 for this CVE and carries no CISA Known Exploited Vulnerabilities flag. The scores in this post come from NVD and may be revised.
Try it yourself
The demo below walks through the same workflow on sample data.
Click through it at your own pace, or open it full screen.
Quick check
Can a firewall rule fix this?
It can reduce exposure, but the fix is in the code. Keep the application off untrusted networks until the query handling is corrected.
Sources
I did not fetch the pages below, so every statement here comes from the NVD record. The VulDB entry and researcher write ups were not independently confirmed. The record states the vendor was contacted early and did not respond.
- https://github.com/V3geD4g/cmseasy_vul/blob/main/SQL1-EN.md
- https://vuldb.com/?ctiid.250693
- https://vuldb.com/?id.250693
Last reviewed: 19 October 2026.
