Bugs in the beanFeed component of Masa CMS allow an attacker to inject SQL statements into the sortDirection parameter, which is concatenated directly into a query without sanitization. The resulting vulnerability enables an unauthenticated attacker to read, modify, or delete database records, and in worst‑case scenarios could lead to remote code execution on the database server. This is a classic SQL Injection flaw (CWE‑89) with a CVSS score of 9.3.

The flaw exists in Masa CMS version 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2. All installations of these releases that expose the beanFeed.cfc component are vulnerable.

The high CVSS score and lack of mitigating controls indicate that exploitation is highly probable over the internet. An attacker can issue a simple HTTP request to the beanFeed.cfc endpoint with a crafted sortDirection value, bypassing authentication, to inject arbitrary SQL. No exploit probability score is currently available, and the vulnerability is not listed in CISA’s KEV catalog, but the attack vector is straightforward and the impact scope includes the entire database managed by the application.