CVE-2024-32640

MASA CMS, an open-source Enterprise Content Management platform, contains a SQL injection flaw (CWE-89) in its `processAsyncObject` method that an attacker can leverage to achieve remote code execution. Because the CVSS vector requires no privileges and no user interaction, the flaw is exploitable remotely by unauthenticated attackers against network-reachable instances. A successful attack grants the attacker full control over the affected server (high confidentiality, integrity, and availability impact), typically by injecting SQL that executes code in the underlying application environment. Organizations running MASA CMS versions prior to 7.4.5, 7.3.12, or 7.2.7 are affected and should move to one of those fixed releases. As of now there is no known public proof-of-concept or confirmed in-the-wild exploitation, but the very high EPSS score (71.6%, 99th percentile) indicates a strong likelihood of exploitation in the next 30 days.

What to do: Upgrade MASA CMS to version 7.4.5, 7.3.12, or 7.2.7 depending on your current branch. Given the pre-authentication RCE risk and high EPSS, prioritize internet-facing instances, and if patching must be delayed, restrict external access to the CMS endpoints that reach `processAsyncObject` (e.g., via WAF rules or network controls) and check logs for suspicious SQL or command-execution activity.