MasaCMS SQL Injection vulnerability
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 70%
de la publicación al arma0 días
Publicada en NVD11 ago
1ª PoC16 may
VulnCheck16 may
probabilidad de explotación
70%top 1% de las CVE
explotación observada
síVulnCheck
7 exploit(s) público(s)
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
MasaCMS · MasaCMSPoCs públicas encontradas — 7
githubgithub.com/Stuub/CVE-2024-32640-SQLI-MuraCMS★ 78githubgithub.com/0xYumeko/CVE-2024-32640-SQLI-MuraCMS★ 1githubgithub.com/pizza-power/CVE-2024-32640★ 1githubgithub.com/sammings/CVE-2024-32640★ 0vulncheckvulncheck.com/xdb/a15fca645bd7no verificadovulncheckvulncheck.com/xdb/984944bdf011no verificadovulncheckvulncheck.com/xdb/a8650a988da7no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/MasaCMS/MasaCMS/commit/259fc6061d022d5025a3289a3f8de9852ad9c91dhttps://github.com/MasaCMS/MasaCMS/commit/280489e2d6c8daf5022fdb0225235462dd9d4534https://github.com/MasaCMS/MasaCMS/commit/3d6319b8775bb6438bc822d845926990511f5075https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-24rr-gwx3-jhqchttps://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMShttps://projectdiscovery.io/blog/hacking-apple-with-sql-injection?ref=projectdiscovery-io-blog-newsletterhttps://www.seebug.org/vuldb/ssvid-99835