Executive Summary

CVE-2026-40331 is a critical SQL Injection vulnerability in Masa CMS versions 7.2.0 through 7.5.2. The issue arises because the unauthenticated JSON API accepts an altTable parameter that is passed to the setAltTable() method without any validation or sanitization. This parameter is directly injected into a SQL FROM clause, allowing an attacker to supply arbitrary subqueries.

As a result, an unauthenticated attacker can exploit this flaw to read sensitive data from any table in the database with a single HTTP request, including administrative credentials and password reset tokens.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive data stored in the database, such as administrative credentials and password reset tokens.

An attacker can take over admin accounts, potentially leading to full system compromise. The vulnerability also opens the door for remote code execution, which can further escalate the attacker's control over the affected system.

The vulnerability affects all instances of Masa CMS with the JSON API enabled and has a high severity with a CVSS score of 9.8 (Critical).

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the Masa CMS JSON API for suspicious usage of the altTable parameter, especially if it contains SQL subqueries or non-alphanumeric characters.

You can use network monitoring tools or web server logs to identify such requests.

For example, using command-line tools like curl or grep to search for suspicious altTable parameters in access logs:

• grep 'altTable=' /path/to/access.log
• curl -v 'http://your-masa-cms-site/api/json?altTable=...' to test if the parameter is accepted and behaves unexpectedly.

Additionally, deploying Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the altTable parameter can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Upgrade Masa CMS to a fixed version: 7.2.10, 7.3.15, 7.4.10, or 7.5.3.
• If upgrading is not immediately possible, apply manual validation to the setAltTable function in core/mura/content/feed/feedBean.cfc to restrict input to simple alphanumeric table names.
• Disable the JSON API if it is not required.
• Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the altTable parameter.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated attacker to read sensitive data from any table in the database, including administrative credentials and password reset tokens. Such unauthorized access to sensitive personal and administrative data can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Exploitation of this SQL Injection vulnerability could result in data breaches, exposing personal data and credentials, thereby compromising compliance with standards that mandate confidentiality, integrity, and security of sensitive data.

Useful 0 Not Useful 0