Actively exploited in the wild
Fuel CMS SQL Injection Vulnerability
Fuel CMS - Fuel CMS · Listed in the CISA KEV since 2021-12-10. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-17463
CriticalCVSS 9.8KEVSummary
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. An attacker can manipulate database queries.
Risk Assessment
SQL injection may allow an attacker to read, modify or delete database data and, in some configurations, execute commands on the server.
Recommendation
Update FUEL CMS to a version later than 1.4.7 when available, or apply vendor patches. Restrict access to the administrative panel and validate input on the application side.
Other vulnerabilities in FUEL CMS
See all- CVE-2021-47980High
Fuel CMS version 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface.
- CVE-2023-33557High
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
Original NVD description (English source)
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.