CVE-2026-40329: Masa CMS SQL Injection Vulnerability

CVE-2026-40329 Overview

CVE-2026-40329 is a SQL injection vulnerability [CWE-89] in Masa CMS, an open source content management system. The flaw exists in the beanFeed.cfc component, where the getQuery function processes the sortBy parameter without proper sanitization or parameterization. Versions 7.5.2 and earlier are affected. An unauthenticated remote attacker can inject arbitrary SQL commands into dynamic SQL statements executed by the application. Successful exploitation can expose sensitive data, modify or delete records, and escalate privileges to administrative control. The issue is fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3.

Critical Impact

Unauthenticated remote attackers can execute arbitrary SQL against the backend database, leading to full compromise of stored data and potential administrative takeover.

Affected Products

• Masa CMS versions 7.5.0 through 7.5.2
• Masa CMS versions 7.4.0 through 7.4.9
• Masa CMS versions 7.3.0 through 7.3.14 and 7.2.0 through 7.2.9

Discovery Timeline

• 2026-05-05 - CVE-2026-40329 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-40329

Vulnerability Analysis

The vulnerability resides in the beanFeed.cfc ColdFusion component shipped with Masa CMS. Inside the getQuery function, the sortBy parameter supplied through HTTP requests is concatenated directly into a dynamic SQL statement. The application does not apply parameterized queries or input validation to this value before passing it to the database engine.

Because beanFeed.cfc is reachable without authentication, an attacker only needs network access to the Masa CMS instance to trigger the flaw. Crafted sortBy values terminate the intended ORDER BY clause and append additional SQL syntax such as UNION SELECT queries, stacked statements, or time-based blind payloads. The database executes the attacker-controlled SQL with the privileges of the Masa CMS database account.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The getQuery function builds SQL through string concatenation rather than prepared statements with bound parameters. Input that should be restricted to a column name or sort direction is treated as trusted SQL text.

Attack Vector

Exploitation requires only a network-reachable HTTP endpoint exposed by beanFeed.cfc. No authentication, user interaction, or elevated privileges are required. An attacker submits an HTTP request supplying malicious SQL fragments in the sortBy parameter. Depending on database permissions, the attacker can read arbitrary tables, write or delete records, enumerate schema metadata, or pivot to operating system command execution through database-specific features.

No verified public proof-of-concept code is available at this time. See the GitHub Security Advisory for additional technical context.

Detection Methods for CVE-2026-40329

Indicators of Compromise

• HTTP requests to URIs containing beanFeed.cfc with unusual sortBy query string values containing SQL keywords such as UNION, SELECT, SLEEP, --, or ;
• Web server or application logs showing repeated beanFeed.cfc requests from a single source with varying sortBy payloads
• Database error messages or query timeouts correlated with beanFeed.cfc requests
• Unexpected new administrative accounts or modified content records in the Masa CMS database

Detection Strategies

• Inspect web access logs for sortBy parameter values that include SQL metacharacters or encoded equivalents (%27, %20OR%20, %3B)
• Enable database query auditing to flag dynamic queries originating from beanFeed.cfc that contain UNION operators or sleep functions
• Correlate WAF alerts on SQL injection signatures with backend ColdFusion application logs to confirm exploitation attempts

Monitoring Recommendations

• Forward Masa CMS application logs, web server logs, and database audit logs to a centralized analytics platform for correlation
• Alert on bursts of HTTP 500 responses from beanFeed.cfc that may indicate injection probing
• Track outbound database traffic for anomalous bulk reads consistent with data exfiltration following successful injection

How to Mitigate CVE-2026-40329

Immediate Actions Required

• Upgrade Masa CMS to version 7.2.10, 7.3.15, 7.4.10, or 7.5.3 depending on the deployed branch
• Restrict network access to beanFeed.cfc until patching is complete, particularly from untrusted networks
• Review database audit logs for prior exploitation attempts targeting the sortBy parameter
• Rotate database credentials used by Masa CMS if exploitation is suspected

Patch Information

The Masa CMS maintainers released fixed versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. The patch replaces unsafe string concatenation in the getQuery function of beanFeed.cfc with parameterized SQL. Refer to the Masa CMS GitHub Security Advisory GHSA-3xpq-q494-8qq4 for full release details.

Workarounds

• Configure Web Application Firewall (WAF) rules to block requests to beanFeed.cfc containing SQL keywords or metacharacters in the sortBy parameter
• Apply allowlist validation at a reverse proxy to restrict sortBy values to a fixed set of column names
• Limit the database account used by Masa CMS to least privilege, removing schema modification and administrative rights where possible

# Example ModSecurity rule blocking SQL patterns in sortBy parameter
SecRule ARGS:sortBy "@rx (?i)(union(\s)+select|sleep\s*\(|;|--|/\*|\bor\b\s+\d+=\d+)" \
    "id:1040329,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-40329 Masa CMS beanFeed.cfc sortBy SQL injection attempt',\
    logdata:'Matched sortBy=%{MATCHED_VAR}'"