CVE-2023-33557
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to data leakage or modification.
Recommendation
It is recommended to update Fuel CMS to the latest version to mitigate this vulnerability and review the code to secure input parameters.
Other vulnerabilities in Fuel CMS v1.5.2
See all- CVE-2021-47980High
Fuel CMS version 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface.
- CVE-2020-17463CriticalActively exploited
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. An attacker can manipulate database queries.
Original NVD description (English source)
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS