PT-2021-11072 · Fuel Cms · Fuel Cms

C0Mpu7Er · Published 2021-03-10 · Updated 2021-03-12 · CVE-2020-24791

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FUEL CMS version 1.4.8

Description: The issue allows SQL injection via the fuel replace id parameter in the "pages/replace/1" endpoint. Exploiting this could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Recommendations: For FUEL CMS version 1.4.8, consider disabling the fuel replace id parameter in the "pages/replace/1" endpoint as a temporary workaround until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the fuel replace id parameter until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-24791

Affected Products

Fuel Cms

References · 7

• 🔥 https://github.com/daylightstudio/FUEL-CMS/issues/561 · Exploit
• 🔥 https://exploit-db.com/exploits/48778 · Exploit
• 🔥 https://github.com/leerina/vulnerability/blob/master/Fuel%20CMS%201.4.8%20SQLi%20vulnerability.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24791 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24791 · Vendor Advisory
• https://t.me/cibsecurity/24678 · Telegram Post
• https://t.me/cvenotify/11280 · Telegram Post