CyberRota Analysis
AI-GeneratedMura CMS versions prior to 10.0.712 are vulnerable to a critical remote code execution flaw due to insufficient validation of the "method" parameter in POST requests to the endpoint "/index.cfm/_api/json/v1/default." This vulnerability allows remote attackers to inject and execute arbitrary CFML expressions, potentially leading to the instantiation of malicious Java objects and compromising system security. Organizations using affected versions of Mura CMS should prioritize immediate updates to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.