A critical authentication bypass in MacCMS 2025 allows unauthorized remote execution of backend scheduled tasks, posing a significant risk of service disruption and system manipulation.

The vulnerability exists in the Timming API endpoint at application/api/controller/Timming.php, which explicitly skips authentication checks for incoming requests. Unauthenticated remote attackers can invoke backend controllers by manipulating the request, specifically using the enforce=1 parameter to force the execution of configured scheduled tasks.

The ability for an unauthenticated user to trigger backend tasks can lead to severe operational consequences. Depending on the configured tasks, an attacker could perform unauthorized cache clearing, mass content injection, or trigger external network requests (SSRF), resulting in service degradation, loss of data integrity, and potential reputation damage. Given the CVSS score of 7.3, this vulnerability represents a high-severity threat that requires immediate attention to prevent unauthorized administrative actions.

Immediate Action: Update MacCMS to the latest version provided by the vendor which addresses the authentication bypass in the Timming API controller. If an update is not immediately available, restrict access to the api.php endpoint via network-level controls.

Proactive Monitoring: Review application and web server access logs for anomalous requests to the /api.php/timming/index path, especially those containing the enforce=1 parameter. Monitor scheduled task execution logs for unexpected activity or unauthorized timestamps.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or challenge requests to the /api.php/timming/index endpoint. Ensure that sensitive administrative interfaces are not exposed to the public internet.

Public Exploit Available: Yes — a public proof-of-concept is available via the researcher's GitHub issue (https://github.com/HuajiHD/CVE/issues/9).

This vulnerability is highly dangerous because it allows unauthenticated attackers to hijack backend administrative functionality through a publicly accessible API. Security teams must prioritize patching or isolating the affected MacCMS installation immediately to prevent potential exploitation of the scheduled task mechanism.