.. / CVE-2024-32640

Exploit for Mura/Masa CMS - Unauthenticated SQL Injection (CVE-2024-32640)

Description:

The Mura/Masa CMS is vulnerable to SQL Injection, allowing unauthenticated attackers to execute arbitrary SQL commands via crafted input to the application. This vulnerability can lead to unauthorized access to sensitive data.

Affected Products:

Mura CMS (not fixed)
Masa CMS (fixed in 7.4.6, 7.3.13 and 7.2.8)

Proof of Concept

PoC exploits

https://blog.projectdiscovery.io/hacking-apple-with-sql-injection/

Nuclei Template

View the template here CVE-2024-32640.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2024/CVE-2024-32640.yaml

References:

https://nvd.nist.gov/vuln/detail/CVE-2024-32640

.. / CVE-2024-32640 if(localStorage["style"]=="true"){ document.getElementById('pagestyle').setAttribute('href','/assets/styleDark.css'); document.querySelector('input[type="checkbox"]').checked = true }