Mura CMS version 10.1.13 and earlier implement a beanFeed.cfc component that constructs an SQL query using a client‑supplied sortDirection value without parameterization. This flaw permits an unauthenticated remote attacker to inject arbitrary SQL into the ORDER BY clause, which can lead to data exfiltration, modification, or deletion from the underlying database. The vulnerability corresponds to CWE‑89, improper neutralization of special elements used in an SQL command.

The issue impacts all installations of Mura CMS older than version 10.1.14, irrespective of the operating system or web server. Any environment that exposes the beanFeed.cfc endpoint over HTTP or HTTPS is vulnerable, so administrators should check the CMS version and confirm whether they are on a vulnerable release.

With a CVSS score of 9.8, the vulnerability is considered critical, granting full database access. The EPSS score is below 1%, indicating a low probability of recent exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that an attacker sends a crafted HTTP request containing a malicious sortDirection parameter to the beanFeed.cfc endpoint; no authentication or privileged credentials are needed.