Description
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
maccmspro maccms10
Default version status: unaffected
0 to ≤ 2021.1000.2000affected
magicblack maccms10
Default version status: unaffected
0 to ≤ 2026.1000.4056affected
References
- https://github.com/maccmspro/maccms10/issues/30 ↗
- https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/Card.php#L123-L160 ↗
- https://github.com/maccmspro/maccms10 ↗
- https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-race-condition-via-card-redemption ↗