No, this isn't a fundamental weakness of CBC. In fact, CTR is even more susceptible to this problem (a CBC bitflip totally corrupts the block to which it's applied, and creates a predictable change in the subsequent block; a CTR bitflip simply flips the matching decrypted plaintext bit; in that sense CTR is totally and perfectly malleable).

Also: nobody uses SHA1 anymore, SHA1 and SHA2 aren't MACs (you're thinking of HMAC), and even MD5 is still unbroken in HMAC.