Vulnerability Description
FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thedaylightstudio | Fuel Cms | 1.4.8 |
Related Weaknesses (CWE)
References
- https://github.com/daylightstudio/FUEL-CMS/issues/561ExploitIssue TrackingThird Party Advisory
- https://github.com/leerina/vulnerability/blob/master/Fuel%20CMS%201.4.8%20SQLi%2ExploitThird Party Advisory
- https://www.exploit-db.com/exploits/48778ExploitThird Party AdvisoryVDB Entry
- https://github.com/daylightstudio/FUEL-CMS/issues/561ExploitIssue TrackingThird Party Advisory
- https://github.com/leerina/vulnerability/blob/master/Fuel%20CMS%201.4.8%20SQLi%2ExploitThird Party Advisory
- https://www.exploit-db.com/exploits/48778ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2020-24791?
CVE-2020-24791 is a vulnerability with a CVSS score of 9.8 (CRITICAL). FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or explo...
How severe is CVE-2020-24791?
CVE-2020-24791 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-24791?
Check the references section above for vendor advisories and patch information. Affected products include: Thedaylightstudio Fuel Cms.