CVE-2026-40330: Masa CMS SQL Injection Vulnerability

CVE-2026-40330 Overview

CVE-2026-40330 is a SQL injection vulnerability in Masa CMS, an open source content management system. The flaw resides in the beanFeed.cfc component, specifically in the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL statements without sanitization or parameterization [CWE-89]. An unauthenticated remote attacker can exploit this issue to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server.

Critical Impact

Unauthenticated remote attackers can run arbitrary SQL against the backend database, leading to data theft, data tampering, and possible code execution on the database server.

Affected Products

• Masa CMS versions 7.2.0 through 7.2.9
• Masa CMS versions 7.3.0 through 7.3.14
• Masa CMS versions 7.4.0 through 7.4.9 and 7.5.0 through 7.5.2

Discovery Timeline

• 2026-05-05 - CVE-2026-40330 published to the National Vulnerability Database
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-40330

Vulnerability Analysis

The vulnerability exists in the beanFeed.cfc ColdFusion component shipped with Masa CMS. Inside the getQuery function, the sortDirection request parameter is appended directly into a SQL statement. The application performs no allow-list validation, no escaping, and no use of parameterized queries. As a result, attacker-supplied SQL fragments are executed by the database engine with the privileges of the application's database user.

Because the affected endpoint is reachable without authentication, exploitation requires only network access to the Masa CMS instance. Successful injection can return query results, manipulate stored content, or invoke database-level functionality such as stacked queries or out-of-band channels.

Root Cause

The root cause is improper neutralization of special elements in a SQL command [CWE-89]. The sortDirection parameter, which should be restricted to a fixed set of values such as ASC or DESC, is treated as free-form input and concatenated into the query string passed to the database driver.

Attack Vector

An attacker sends a crafted HTTP request to the public beanFeed.cfc endpoint with a malicious sortDirection value. Typical payloads append UNION SELECT clauses, time-based blind primitives, or stacked statements to enumerate schemas, dump credentials, or alter records. Where the database account holds elevated privileges, attackers can pivot to operating system command execution through database-specific features.

No verified exploit code is published in the referenced advisory. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-40330

Indicators of Compromise

• HTTP requests to beanFeed.cfc containing SQL keywords such as UNION, SELECT, SLEEP, WAITFOR, or -- in the sortDirection parameter.
• Database errors or unusually long response times associated with requests to the beanFeed.cfc endpoint.
• Unexpected new or modified rows in content, user, or session tables following anomalous web traffic.

Detection Strategies

• Inspect web server and application logs for sortDirection values that are not ASC or DESC.
• Deploy SQL injection signatures in a Web Application Firewall (WAF) targeting requests to beanFeed.cfc.
• Correlate web request anomalies with database audit logs to surface query patterns inconsistent with the application baseline.

Monitoring Recommendations

• Forward web server, ColdFusion, and database audit logs to a central analytics platform for cross-source correlation.
• Alert on spikes in 500-level responses or query latency tied to the affected endpoint.
• Track outbound connections from the database host to detect out-of-band exfiltration channels initiated through SQL injection.

How to Mitigate CVE-2026-40330

Immediate Actions Required

• Upgrade Masa CMS to version 7.2.10, 7.3.15, 7.4.10, or 7.5.3, matching your current major release line.
• Restrict network exposure of the Masa CMS administrative and feed endpoints until patching is complete.
• Rotate database credentials and review database audit logs for evidence of prior exploitation.

Patch Information

The Masa CMS maintainers have released fixed versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3 that introduce input validation for the sortDirection parameter. Refer to the GitHub Security Advisory GHSA-56cc-gxfr-hqp8 for release notes and commit references.

Workarounds

• Use a WAF to block or restrict access to the beanFeed.cfc component from untrusted networks.
• Deploy WAF rules that detect SQL injection patterns specifically targeting the sortDirection parameter.
• Limit the database account used by Masa CMS to the minimum privileges required, removing rights to execute administrative or system commands.

# Example WAF rule snippet (ModSecurity) restricting sortDirection values
SecRule ARGS:sortDirection "!@rx ^(ASC|DESC)$" \
    "id:1040330,phase:2,deny,status:403,\
    msg:'CVE-2026-40330: Invalid sortDirection value for beanFeed.cfc'"