CVE-2021-47980: 
Fuel CMS vulnerability analysis and mitigation

CVE-2021-47980 is a blind SQL injection vulnerability in Fuel CMS version 1.4.13 that allows authenticated attackers to manipulate database queries via the col parameter in the Activity Log interface. The vulnerability was published to the NVD and GitHub Advisory Database on May 16, 2026, and is classified as High severity with a CVSS v4 base score of 7.1 (GitHub Advisory). The assigner is VulnCheck, and the affected product is specifically Fuel CMS 1.4.13 (GitHub Advisory).

The root cause is improper neutralization of special elements used in an SQL command (CWE-89), where user-supplied input in the col parameter of the Activity Log endpoint is not adequately sanitized before being incorporated into database queries. An authenticated attacker can craft HTTP requests to the logs endpoint with malicious SQL payloads in the col parameter, exploiting time-based blind SQL injection techniques to infer database contents based on server response delays. Exploitation requires low-level authenticated access (any user with access to the Activity Log interface) and no user interaction, making it straightforward for insiders or compromised accounts to abuse (GitHub Advisory). A public exploit is referenced on Exploit-DB (EDB-50523) (GitHub Advisory).

Successful exploitation allows an authenticated attacker to extract sensitive database information through timing-based analysis, including credentials, user data, and application configuration stored in the database. There is also a low integrity impact, meaning an attacker may be able to modify database content. Availability is not directly impacted, but exposure of sensitive data could facilitate further compromise of the application or underlying infrastructure (GitHub Advisory).

A public exploit for this vulnerability is listed on Exploit-DB (EDB-50523), referenced in the GitHub Advisory (GitHub Advisory). There is no current evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.026–0.029% (9th percentile), indicating a low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authentication: Obtain valid credentials for a Fuel CMS 1.4.13 instance with access to the Activity Log interface (any authenticated user role with this access suffices).
2. Identify the target endpoint: Navigate to or directly target the logs endpoint, typically at a URL such as /fuel/logs/ or the equivalent Activity Log admin path.
3. Craft a time-based blind SQL injection payload: Inject a malicious SQL payload into the col parameter of the HTTP request, for example: col=id AND SLEEP(5)-- or a similar time-delay construct appropriate for the underlying database (MySQL).
4. Send the request: Submit the crafted HTTP GET or POST request to the logs endpoint with the malicious col parameter value.
5. Observe response timing: Measure the server's response time — a delayed response (e.g., ~5 seconds) confirms the injection is successful and the database is executing the injected SQL.
6. Extract data: Use iterative boolean or time-based payloads to enumerate database names, table names, column names, and data (e.g., user credentials) character by character, or automate with tools like sqlmap targeting the col parameter (GitHub Advisory).

• Network: Unusual HTTP requests to the Fuel CMS Activity Log endpoint (e.g., /fuel/logs/) with col parameter values containing SQL keywords such as SLEEP, BENCHMARK, AND, OR, SELECT, UNION, or encoded equivalents.
• Logs: Web server access logs showing repeated requests to the logs endpoint with varying col parameter values and abnormal response times (e.g., responses consistently delayed by several seconds); patterns consistent with iterative enumeration (sequential character-by-character queries).
• Database: Database query logs (if enabled) showing time-delay functions (SLEEP(), BENCHMARK()) being executed from the application's database user account.
• Application: Anomalous Activity Log page access from accounts not typically associated with administrative log review, especially at unusual hours.

No official patch from the Fuel CMS vendor has been confirmed for version 1.4.13 as of the advisory publication date (GitHub Advisory). Recommended mitigations include implementing parameterized queries or prepared statements for all database operations, particularly for the col parameter in the Activity Log interface. Additional controls include strict input validation and allowlisting for the col parameter (e.g., only permitting known column names), enforcing the principle of least privilege for database accounts, deploying a Web Application Firewall (WAF) with SQL injection detection rules, and monitoring logs for timing anomalies or suspicious query patterns.