CVE-2020-23722: 
Fuel CMS vulnerability analysis and mitigation

A privilege escalation vulnerability was discovered in FUEL CMS version 1.4.7 that allows unauthorized users to obtain super admin privileges through manipulation of the 'id' and 'fuel_id' parameters (CISA Bulletin, GitHub Issue).

The vulnerability exists in FUEL CMS 1.4.7's user management functionality. Non-administrator users can exploit this vulnerability by intercepting and modifying the 'id' and 'fuel_id' parameters during account modification requests. This allows them to alter administrator account credentials without proper authorization (GitHub Issue).

When successfully exploited, this vulnerability allows an attacker with a regular user account to escalate their privileges to super administrator level. This gives them complete control over the CMS, including the ability to modify administrator passwords and account information (GitHub Issue).

The vulnerability is relatively easy to exploit and requires only a valid non-administrator user account. The attack can be executed by intercepting and modifying specific parameters during account modification requests (GitHub Issue).

Users should upgrade to a version newer than FUEL CMS 1.4.7 that contains patches for this vulnerability (CISA Bulletin).