MASA CMS CVE-2024-32640
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the processAsyncObject method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
AnalysisAI
MASA CMS versions prior to 7.4.5 contain a critical SQL injection vulnerability in the processAsyncObject method that enables unauthenticated remote code execution. The flaw allows attackers to extract database contents and leverage database-specific features to execute OS commands on the underlying server.
Technical ContextAI
The processAsyncObject endpoint fails to sanitize user-controlled input before incorporating it into SQL queries. Because MASA CMS supports multiple database backends (MySQL, MSSQL, Oracle), attackers can use database-specific features like xp_cmdshell (MSSQL), INTO OUTFILE (MySQL), or UTL_HTTP (Oracle) to escalate from SQLi to full command execution.
Affected ProductsAI
MASA CMS < 7.4.5 MASA CMS < 7.3.12 MASA CMS < 7.2.7 Mura CMS (predecessor)
RemediationAI
Update to MASA CMS 7.4.5, 7.3.12, or 7.2.7 immediately. Deploy WAF rules targeting SQL injection patterns on CMS endpoints. Audit database user privileges to ensure the CMS database account lacks FILE and EXECUTE permissions.
Share
External POC / Exploit Code
Leaving vuln.today