Actively exploited · Published Aug 13, 2020 · Assigned by mitre
CVE-2020-17463
Critical 9.8 Exploited
In plain English
A critical-severity SQL injection in Fuel CMS from Fuel CMS. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 89.7% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)89.7%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Dec 10, 2021
Attack tooling1Nuclei
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 10, 2022.
Official description
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cwe.mitre.org/data/definitions/89.html x_refsource_MISC
- https://getfuelcms.com x_refsource_MISC
- https://github.com/daylightstudio/FUEL-CMS/archive/master.zip x_refsource_MISC
- http://packetstormsecurity.com/files/158840/Fuel-CMS-1.4.7-SQL-Injection.html x_refsource_MISC
- https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.8 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17463 government-resource