CVE-2024-32640

MasaCMS SQL Injection vulnerability

MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.6, 7.3.13, and 7.2.8 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.6, 7.3.13, and 7.2.8 contain a fix for the issue.

Affected

MasaCMS

CVSS v3.1 GITHUB

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

77.08% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical

Published

2025-08-11

Updated

2025-12-03

Proof-of-concept exploits (5)

• 0x3f3c/CVE-2024-32640-SQLI-MuraCMS1★ · 2024-05-17
• 0xYumeko/CVE-2024-32640-SQLI-MuraCMS1★ · 2024-05-17
• pizza-power/CVE-2024-326401★ · 2024-11-15
• sammings/CVE-2024-326400★ · 2024-06-06
• Stuub/CVE-2024-32640-SQLI-MuraCMS79★ · 2024-05-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32640.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-24919
• CVE-2016-4437
• CVE-2017-10271
• CVE-2019-2729
• CVE-2021-22204
• CVE-2021-22205