Masa CMS is vulnerable to SQL injection through the sortBy parameter in the beanFeed.cfc component. Because the input is concatenated into a dynamic SQL query without sanitization or parameterization, an attacker can inject arbitrary SQL statements. This flaw can compromise confidentiality, integrity, and availability of the underlying database, allowing data exfiltration, modification, deletion, or privilege escalation to administrative roles. The weakness corresponds to CWE-89: SQL Injection.

The affected product is MasaCMS MasaCMS, specifically versions 7.5.2 and earlier. The vulnerability is mitigated in released versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. Administrators should confirm their installation is at a patched level or higher. A suggested temporary safeguard is to enforce WAF rules that block malicious SQL patterns in the sortBy parameter when it is sent to beanFeed.cfc.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is not provided, and the issue is not listed in the CISA KEV catalog, so publicly available exploitation data is limited. Based on the description, the likely attack vector is an unauthenticated remote attacker sending crafted sortBy values within HTTP requests to beanFeed.cfc, which triggers the vulnerable SQL statement. The lack of authentication requirement and the dynamic query construction make exploitation straightforward for an attacker who can observe the endpoint.