Vulnerability details
CVE-2024-32640
MasaCMS MasaCMS
MasaCMS SQL Injection vulnerability
CVSS 3.1
9.8Critical
Official description
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| MasaCMS | MasaCMS | < 7.2.7 | CVEProject cvelistV5 (CNA) |
| MasaCMS | MasaCMS | >= 7.3.0, < 7.3.12 | CVEProject cvelistV5 (CNA) |
| MasaCMS | MasaCMS | >= 7.4.0, < 7.4.5 | CVEProject cvelistV5 (CNA) |
References and advisories
7- https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-24rr-gwx3-jhqc x_refsource_CONFIRM
- https://github.com/MasaCMS/MasaCMS/commit/259fc6061d022d5025a3289a3f8de9852ad9c91d x_refsource_MISC
- https://github.com/MasaCMS/MasaCMS/commit/280489e2d6c8daf5022fdb0225235462dd9d4534 x_refsource_MISC
- https://github.com/MasaCMS/MasaCMS/commit/3d6319b8775bb6438bc822d845926990511f5075 x_refsource_MISC
- https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS x_refsource_MISC
- https://projectdiscovery.io/blog/hacking-apple-with-sql-injection?ref=projectdiscovery-io-blog-newsletter x_refsource_MISC
- https://www.seebug.org/vuldb/ssvid-99835 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-08-12
- Last updated
- 2025-12-03
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 40 · Medium
Exploit prediction (EPSS)
78.43%
Probability of exploitation in 30 days
99.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')