← back
CVE-2024-32640

MasaCMS SQL Injection vulnerability

CVSS 9.8 CRITICALEPSS 68.6%CWE-89
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
MasaCMS · MasaCMS
public PoCs found — 4
githubgithub.com/Stuub/CVE-2024-32640-SQLI-MuraCMS★ 78githubgithub.com/0xYumeko/CVE-2024-32640-SQLI-MuraCMS★ 1githubgithub.com/pizza-power/CVE-2024-32640★ 1githubgithub.com/sammings/CVE-2024-32640★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/MasaCMS/MasaCMS/commit/259fc6061d022d5025a3289a3f8de9852ad9c91dhttps://github.com/MasaCMS/MasaCMS/commit/280489e2d6c8daf5022fdb0225235462dd9d4534https://github.com/MasaCMS/MasaCMS/commit/3d6319b8775bb6438bc822d845926990511f5075https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-24rr-gwx3-jhqchttps://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMShttps://projectdiscovery.io/blog/hacking-apple-with-sql-injection?ref=projectdiscovery-io-blog-newsletterhttps://www.seebug.org/vuldb/ssvid-99835