EUVD-2025-208836
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.
Analysis
A SQL injection vulnerability exists in the beanFeed.cfc component of Mura CMS, specifically in the getQuery function's sortDirection parameter, affecting versions prior to 10.1.14. An attacker can inject arbitrary SQL commands through the sortDirection parameter to read, modify, or delete database contents without requiring authentication. The vulnerability is classified as SQL injection (SQLi) and patches are available in version 10.1.14 and later.
Technical Context
Mura CMS is a content management system built on ColdFusion/CFML. The vulnerability resides in the beanFeed.cfc ColdFusion component, which handles feed-related queries. The getQuery function fails to properly sanitize or parameterize the sortDirection input parameter before incorporating it into dynamic SQL queries. This is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) where user-supplied input is concatenated directly into SQL statements without parameterization or escaping. The sortDirection parameter, intended to specify ascending or descending sort order, becomes an attack vector when an attacker supplies malicious SQL syntax instead of expected directional values.
Affected Products
Mura CMS versions prior to 10.1.14 are affected by this vulnerability. The beanFeed.cfc component is part of the core CMS installation. Upgrade guidance and release notes are available in the official Mura documentation at https://docs.murasoftware.com/v10/release-notes/#section-version-1014. All deployments running version 10.1.13 or earlier should be considered at risk.
Remediation
Immediately upgrade Mura CMS to version 10.1.14 or later from the official Mura Software release channels. The patch addresses SQL injection by implementing proper query parameterization in the beanFeed.cfc getQuery function. Verify the upgrade by checking the version displayed in Mura administration panels and test feed functionality post-deployment. As an interim mitigation for systems that cannot be immediately patched, restrict network access to the beanFeed component endpoints to trusted internal networks only, implement a Web Application Firewall (WAF) with SQL injection detection rules, and review access logs for suspicious sortDirection parameter values containing SQL syntax. After patching, conduct a database audit to ensure no unauthorized data access or modifications occurred during the vulnerability window.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today