PT-2024-4567 · Unknown · Mura/Masa Cms

Published 2024-05-13 · Updated 2025-12-03 · CVE-2024-32640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MASA CMS versions prior to 7.4.6 MASA CMS versions prior to 7.3.13 MASA CMS versions prior to 7.2.8

Description: MASA CMS, an Enterprise Content Management platform, contains a SQL injection vulnerability in the processAsyncObject method. Exploitation of this vulnerability can lead to remote code execution. The vulnerability is present in versions prior to 7.4.6, 7.3.13, and 7.2.8. The API endpoint /index.cfm/ api/json/v1/default/?method=processAsyncObject is vulnerable, specifically with the object, contenthistid, and previewid parameters.

Recommendations: MASA CMS versions prior to 7.4.6: Update to version 7.4.6 or later. MASA CMS versions prior to 7.3.13: Update to version 7.3.13 or later. MASA CMS versions prior to 7.2.8: Update to version 7.2.8 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-05072

CVE-2024-32640

GHSA-24RR-GWX3-JHQC

Affected Products

Mura/Masa Cms

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32640.json · Exploit
• 🔥 https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32640 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32640 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05072 · Security Note
• https://github.com/MasaCMS/MasaCMS/commit/280489e2d6c8daf5022fdb0225235462dd9d4534 · Note
• https://github.com/MasaCMS/MasaCMS/commit/3d6319b8775bb6438bc822d845926990511f5075 · Note
• https://github.com/MasaCMS/MasaCMS/commit/259fc6061d022d5025a3289a3f8de9852ad9c91d · Note
• https://github.com/MasaCMS/MasaCMS/releases/tag/7.2.8 · Note
• https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-24rr-gwx3-jhqc · Note
• https://github.com/MasaCMS/MasaCMS/releases/tag/7.4.6 · Note
• https://github.com/MasaCMS/MasaCMS/releases/tag/7.3.13 · Note
• https://t.me/proxy_bar/2085 · Telegram Post
• https://twitter.com/DarkWebInformer/status/1955304422302425591 · Twitter Post
• https://t.me/brutsecurity/382 · Telegram Post