CVE-2020-17463: 
Fuel CMS vulnerability analysis and mitigation

FUEL CMS 1.4.7 contains a SQL injection vulnerability (CVE-2020-17463) that allows attackers to perform SQL injection via the col parameter to multiple endpoints including /pages/items, /permissions/items, or /navigation/items. This vulnerability was discovered and disclosed on August 13, 2020 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The issue affects the col parameter in multiple endpoints of FUEL CMS version 1.4.7 (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized access to sensitive data, modification of database contents, or compromise of the application's functionality (CISA).

The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog on December 10, 2021, indicating active exploitation in the wild. The vulnerability is relatively easy to exploit as it requires no authentication or user interaction (CISA).

The vulnerability has been fixed in FUEL CMS version 1.4.8. Organizations are strongly advised to upgrade to this version or later. CISA has set a remediation date of June 10, 2022, for federal agencies to address this vulnerability (FUEL CMS).