Executive brief
Masa CMS, an open-source content management system, contains a critical security flaw that allows attackers to interfere with its database. By sending a specially crafted web request, an unauthorized person could steal sensitive data, modify website content, or potentially take control of the database server. This could lead to a total loss of data confidentiality and website downtime.
Technical details
A SQL injection vulnerability exists in Masa CMS within the beanFeed.cfc component's getQuery function. The vulnerability is caused by the 'sortDirection' parameter being concatenated directly into SQL queries without proper sanitization or parameterization. An unauthenticated remote attacker can exploit this via network requests to execute arbitrary SQL commands. This can result in the extraction of sensitive information, modification or deletion of database records, and in some configurations, remote code execution (RCE) on the database server. Patches are available in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3.
Affected products
- Masa CMS MasaCMS 7.2.0 - 7.2.9, 7.3.0 - 7.3.14, 7.4.0 - 7.4.9, 7.5.0 - 7.5.2
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-05: disclosed: NVD publication date