{"id":"CVE-2024-32640","aliases":["EUVD-2024-30442","GHSA-24rr-gwx3-jhqc"],"status":"published","title":"MasaCMS SQL Injection vulnerability","description":"MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.78435,"percentile":0.99587,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2025-08-11T20:38:56Z","modified":"2026-10-28T02:30:36Z","exploits":[{"source":"nuclei","id":"CVE-2024-32640","title":"Mura/Masa CMS - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32640.yaml"},{"source":"pocgithub","id":"0xYumeko/CVE-2024-32640-SQLI-MuraCMS","title":"0xYumeko/CVE-2024-32640-SQLI-MuraCMS","date":"2024-05-17","url":"https://github.com/0xYumeko/CVE-2024-32640-SQLI-MuraCMS"},{"source":"pocgithub","id":"Stuub/CVE-2024-32640-SQLI-MuraCMS","title":"Stuub/CVE-2024-32640-SQLI-MuraCMS","date":"2024-05-16","url":"https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS"},{"source":"pocgithub","id":"pizza-power/CVE-2024-32640","title":"pizza-power/CVE-2024-32640","date":"2024-11-12","url":"https://github.com/pizza-power/CVE-2024-32640"},{"source":"pocgithub","id":"sammings/CVE-2024-32640","title":"sammings/CVE-2024-32640","date":"2024-06-06","url":"https://github.com/sammings/CVE-2024-32640"}],"products":[{"vendor":"masacms","product":"masacms"}],"references":[{"url":"https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-24rr-gwx3-jhqc","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/MasaCMS/MasaCMS/commit/259fc6061d022d5025a3289a3f8de9852ad9c91d","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/MasaCMS/MasaCMS/commit/280489e2d6c8daf5022fdb0225235462dd9d4534","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/MasaCMS/MasaCMS/commit/3d6319b8775bb6438bc822d845926990511f5075","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS","tags":["x_refsource_MISC","package"]},{"url":"https://projectdiscovery.io/blog/hacking-apple-with-sql-injection?ref=projectdiscovery-io-blog-newsletter","tags":["x_refsource_MISC","article"]},{"url":"https://www.seebug.org/vuldb/ssvid-99835","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32640.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32640","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-32640","title":"MasaCMS SQL Injection vulnerability","description":"MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.","status":"published","published":"2025-08-11T20:38:56.268Z","modified":"2025-12-03T16:03:56.147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:15.662528Z"}],"euvd":[{"id":"EUVD-2024-30442","description":"MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.","status":"published","published":"2025-08-11T20:38:56Z","modified":"2025-12-03T16:03:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:10.321316Z"}],"nvd":[{"id":"CVE-2024-32640","description":"MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.","status":"published","published":"2025-08-11T21:15:26.647Z","modified":"2026-06-17T07:30:00.553Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:47.444899Z"}],"osv":[{"id":"CVE-2024-32640","title":"MasaCMS SQL Injection vulnerability","description":"MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.","status":"published","published":"2025-08-11T20:38:56.268Z","modified":"2026-10-28T02:30:36.056767151Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:40.391953Z"}]}}