CVE-2021-47980
HighSummary
Fuel CMS version 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface.
Risk Assessment
Attackers can send malicious requests to the logs endpoint, potentially leading to the disclosure of database information based on response time delays.
Recommendation
It is recommended to update Fuel CMS to the latest version and implement additional security measures such as input validation.
Original NVD description (English source)
Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL payloads in the 'col' parameter to extract database information based on response time delays.