CVE-2020-28705: 
Fuel CMS vulnerability analysis and mitigation

FUEL CMS version 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to delete pages via a post ID to /pages/delete/3. The vulnerability was discovered and reported on November 5, 2020 (GitHub Issue).

The vulnerability exists in the page deletion functionality of FUEL CMS 1.4.13. The application fails to implement proper CSRF protections when processing page deletion requests. The CVSS v3.1 base score is 4.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

An attacker can exploit this vulnerability to delete arbitrary pages from the CMS without proper authorization. This could result in loss of content and disruption of website functionality (NVD).

The vulnerability can be exploited by crafting a malicious request to the /pages/delete/ endpoint. The attack requires user interaction, as it is a CSRF vulnerability. A proof of concept exploit has been publicly disclosed (GitHub Issue).

The vulnerability has been patched in a subsequent release. The fix includes expanded validation of page deletion requests and improved CSRF protection mechanisms (GitHub Patch).