Executive brief
Masa CMS, an open-source content management system, is vulnerable to a critical security flaw that allows attackers to manipulate database queries. By sending specially crafted requests, an unauthenticated attacker can gain full access to sensitive site data, modify or delete records, and potentially take over administrative control of the website. This issue affects all installations prior to the latest security patches and could lead to total data loss or unauthorized site modification.
Technical details
A SQL injection vulnerability exists in Masa CMS versions 7.5.2 and earlier within the beanFeed.cfc component. The flaw is located in the getQuery function, which fails to properly sanitize or parameterize the 'sortBy' parameter before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can exploit this via the network to execute arbitrary SQL commands against the backend database. This can result in the extraction of sensitive data (PII, credentials), modification of database records, or privilege escalation. Patches are available in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3.
Affected products
- MasaCMS Masa CMS <= 7.5.2
Timeline
- 2026-04-30: advisory: Vendor advisory published on GitHub
- 2026-05-05: disclosed: CVE published to NVD