CVE-2024-32640
CRITICAL EXPLOITED NUCLEIMASA CMS <7.4.5-7.2.7 - SQL Injection
Title source: llmExploitation Summary
CVE-2024-32640 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including Stuub, pizza-power, 0xYumeko. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python script that detects and exploits a SQL injection vulnerability (CVE-2024-32640) in Mura CMS by sending a crafted POST request with an escape sequence (`%5c`) in the `contenthistid` parameter. It also integrates with Ghauri for automated exploitation.
Description
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
Exploits (4)
This repository contains a functional Python script that detects and exploits a SQL injection vulnerability (CVE-2024-32640) in Mura CMS by sending a crafted POST request with an escape sequence (`%5c`) in the `contenthistid` parameter. It also integrates with Ghauri for automated exploitation.
This repository contains a functional Python script demonstrating a time-based blind SQL injection exploit for CVE-2024-32640, targeting MySQL databases. It includes both vulnerability detection and data extraction capabilities (e.g., database name, user).
This repository contains a functional exploit script for CVE-2024-32640, a SQL injection vulnerability in Mura CMS. The script checks for vulnerability by sending a crafted POST request and confirms exploitation via Ghauri for further SQL injection attacks.
This repository contains a functional Python script that exploits a time-based SQL injection vulnerability in Mura CMS (CVE-2024-32640). The script sends a crafted POST request with a SLEEP-based payload to detect the vulnerability by measuring response time delays.
Nuclei Templates (1)
Generator: Masa CMS || generator: masa cms
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H