Platform
php
Component
masacms
Fixed in
7.4.1
7.3.1
7.2.8
CVE-2024-32640 describes a critical SQL Injection vulnerability discovered in MASA CMS. This flaw allows attackers to potentially execute arbitrary code on vulnerable systems. The vulnerability affects versions of MASA CMS up to and including 7.4.4. A patch is available in version 7.4.5, addressing the issue.
The SQL Injection vulnerability in MASA CMS allows an attacker to inject malicious SQL code into database queries. Successful exploitation could lead to unauthorized access to sensitive data, including user credentials, financial information, and proprietary business data. Furthermore, an attacker could leverage this vulnerability to execute arbitrary commands on the underlying server, potentially leading to complete system compromise and data exfiltration. The ability to execute commands grants the attacker significant control over the affected system, enabling them to install malware, modify system configurations, or launch further attacks against other systems within the network.
The vulnerability has been publicly disclosed and assigned a CVSS score of 9.8 (CRITICAL), indicating a high probability of exploitation. While no active exploitation campaigns have been publicly confirmed at the time of writing, the ease of exploitation and the potential impact make it a high-priority target for attackers. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are likely to emerge given the severity and ease of exploitation.
Exploit Status
EPSS
93.72% (100% percentile)
CISA SSVC
CVSS Vector
Exploitation detected
NextGuard recorded active exploitation indicators in public threat intel feeds.
The primary mitigation for CVE-2024-32640 is to immediately upgrade MASA CMS to version 7.4.5 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as input validation and parameterized queries to prevent SQL injection attacks. Web Application Firewalls (WAFs) configured to detect and block SQL injection attempts can also provide an additional layer of protection. Regularly review and update database access controls to minimize the potential impact of a successful attack. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection payload on the affected endpoint and verifying that it is properly sanitized.
Update MasaCMS to version 7.4.5, 7.3.12, or 7.2.7 or later. These versions contain the fix for the SQL injection (SQL Injection) vulnerability. It is recommended to create a backup before updating.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-32640 is a critical SQL Injection vulnerability in MASA CMS versions up to 7.4.4, allowing attackers to potentially execute code on the server.
You are affected if you are running MASA CMS versions 7.4.4 or earlier, including 7.3.12 and 7.2.7. Check your version and upgrade immediately.
Upgrade MASA CMS to version 7.4.5 or later to patch the vulnerability. Consider temporary workarounds like input validation if immediate upgrade is not possible.
While no active exploitation campaigns have been confirmed, the high severity and ease of exploitation suggest a high likelihood of future attacks.
Refer to the official MASA CMS security advisory for detailed information and updates regarding CVE-2024-32640.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.