CVE-2020-26045: 
Fuel CMS vulnerability analysis and mitigation

FUEL CMS version 1.4.11 contains a SQL Injection vulnerability (CVE-2020-26045) that was discovered in September 2020. The vulnerability exists in the permissions creation functionality, specifically via the 'name' parameter in the /fuel/permissions/create/ endpoint. This security flaw affects the core functionality of the content management system (GitHub Issue).

The vulnerability allows SQL Injection through the 'name' parameter when creating permissions. An example exploit payload is 'a")or extractvalue(1,concat(0x23,user()))#', which can be sent via a POST request to /fuel/permissions/create/. The attack vector involves manipulating the multipart/form-data request with maliciously crafted input (CISA Bulletin).

Successful exploitation of this vulnerability could allow attackers to compromise the application, access or modify data in the underlying database, and potentially exploit additional latent vulnerabilities. The severity of this issue is rated as high with a CVSS score of 7.5, indicating significant potential impact on system confidentiality, integrity, and availability (CISA Bulletin).

The vulnerability is exploitable through the web interface by sending specially crafted POST requests to the permissions creation endpoint. A proof of concept exploit has been publicly disclosed, demonstrating the ability to extract database user information through SQL injection (GitHub Issue).