{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-32640/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-32640/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-32640/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-32640/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-32640/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-32640"},"sightings":{"href":"/api/v1/sightings/cve-2024-32640"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.76558,"kev":false,"percentile":0.99526},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-32640.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-32640\n\ninfo:\n  name: Mura/Masa CMS - SQL Injection\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    The Mura/Masa CMS is vulnerable to SQL Injection.\n  impact: |\n    Successful exploitation could lead to unauthorized access to sensitive data.\n  remediation: |\n    Apply the vendor-supplied patch or update to a secure version.\n  reference:\n    - https://blog.projectdiscovery.io/hacking-apple-with-sql-injection/\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32640\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: masacms\n    product: masacms\n    shodan-query:\n      - 'Generator: Masa CMS'\n      - \"generator: masa cms\"\n  tags: cve,cve2024,sqli,cms,masa,masacms,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        object=displayregion&contenthistid=x\\'&previewid=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains(header, \"application/json\")'\n          - 'contains_all(body, \"Unhandled Exception\")'\n          - 'contains_all(header,\"cfid\",\"cftoken\")'\n        condition: and\n# digest: 4a0a00473045022078d92b4c4de007a16f75d6bd78fb4d72bee87d230677eb12e51649f1657b27390221009cd193441782228f601c66952bd14b654936ed16a8141c126faf3d9736bb185c:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-32640"}