Fuel CMS · Fuel CMS

CVE-2020-17463

Fuel CMS SQL Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 90%

What it is

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: June 10, 2022

Added to the CISA list: December 10, 2021
Published: August 13, 2020
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 90% in the top 0.2% of all known vulnerabilities
Weakness: CWE-89
More details: NVD · CVE.org · CISA

All references (5)

https://cwe.mitre.org/data/definitions/89.html
https://getfuelcms.com
https://github.com/daylightstudio/FUEL-CMS/archive/master.zip
http://packetstormsecurity.com/files/158840/Fuel-CMS-1.4.7-SQL-Injection.html
https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.8

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.