CVE-2020-17463criticalunder attackCWE-89

CVE-2020-17463

Published · Updated

Follow this CVE+ Monitor Fuel CMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 90%
from disclosure to weapon
Published on NVDAug 13
CISA KEV+484d
Action required by CISAfederal deadline: 2022-06-10

Apply updates per vendor instructions.

In short

FUEL CMS 1.4.7 has a critical flaw that allows attackers to inject malicious SQL commands through the 'col' parameter in certain admin pages, potentially giving them access to sensitive database information or full control of the system.

Technical detail

SQL injection vulnerability in FUEL CMS 1.4.7 affecting the 'col' parameter of /pages/items, /permissions/items, and /navigation/items endpoints. An authenticated or unauthenticated attacker can execute arbitrary SQL queries to read, modify, or delete database contents, depending on database permissions and application context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.