SQL Injection Vulnerability in FUEL CMS by Daylight Studio
CVE-2020-24791
Key Information:
- Vendor
Thedaylightstudio
- Status
- Vendor
- CVE Published:
- 10 March 2021
Badges
What is CVE-2020-24791?
FUEL CMS version 1.4.8 suffers from an SQL injection flaw via the 'fuel_replace_id' parameter in the pages/replace/1 endpoint. If an attacker exploits this vulnerability, they could execute unauthorized SQL queries, potentially leading to unauthorized access, data manipulation, or further exploitation of underlying database vulnerabilities. This makes it imperative for users of this CMS to ensure timely updates and implement robust web application security practices. To learn more, refer to related resources and consider employing security plugins to mitigate such risks.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.