MasaCMS SQL Injection vulnerability
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 70%
from disclosure to weapon0 days
Published on NVDAug 11
1st PoCMay 16
VulnCheckMay 16
exploitation probability
70%top 1% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
MasaCMS · MasaCMSpublic PoCs found — 7
githubgithub.com/Stuub/CVE-2024-32640-SQLI-MuraCMS★ 78githubgithub.com/0xYumeko/CVE-2024-32640-SQLI-MuraCMS★ 1githubgithub.com/pizza-power/CVE-2024-32640★ 1githubgithub.com/sammings/CVE-2024-32640★ 0vulncheckvulncheck.com/xdb/a15fca645bd7unverifiedvulncheckvulncheck.com/xdb/984944bdf011unverifiedvulncheckvulncheck.com/xdb/a8650a988da7unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/MasaCMS/MasaCMS/commit/259fc6061d022d5025a3289a3f8de9852ad9c91dhttps://github.com/MasaCMS/MasaCMS/commit/280489e2d6c8daf5022fdb0225235462dd9d4534https://github.com/MasaCMS/MasaCMS/commit/3d6319b8775bb6438bc822d845926990511f5075https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-24rr-gwx3-jhqchttps://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMShttps://projectdiscovery.io/blog/hacking-apple-with-sql-injection?ref=projectdiscovery-io-blog-newsletterhttps://www.seebug.org/vuldb/ssvid-99835