The vulnerability is a classic SQL injection in Mura CMS’s beanFeed.cfc component, specifically in the sortby parameter passed to the getQuery method. This flaw allows an attacker to inject arbitrary SQL statements, potentially reading, altering, or deleting data stored in the system’s database. The weakness is classified as CWE‑89, indicating classic SQL injection.

Affected systems are installations of Mura CMS running any version prior to 10.1.14. The flaw is present wherever beanFeed.cfc handles sortby values, meaning all users who can submit that parameter are potentially impacted.

The CVSS score of 9.8 reflects a high severity, indicating that successful exploitation could lead to full control over the database and potentially the application server. The EPSS score of less than 1% suggests that the vulnerability is unlikely to be widely exploited at present, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would likely target the web interface that accepts the sortby parameter; however, the exact authentication level required is not specified in the description, so it is inferred that an unauthenticated or low‑privileged user could craft the injection.