CVE-2021-47980: Fuel CMS 1.4.13 Blind SQL Injection via col Parameter
Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL payloads in the 'col' parameter to extract database information based on response time delays.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47980?
CVE-2021-47980 is a high severity vulnerability due to its potential for allowing attackers to execute blind SQL injection attacks.
How does CVE-2021-47980 exploit vulnerability in Fuel CMS?
CVE-2021-47980 exploits a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries through the 'col' parameter in the Activity Log interface.
Who is affected by CVE-2021-47980?
CVE-2021-47980 affects authenticated users of Fuel CMS version 1.4.13.
How can I mitigate CVE-2021-47980?
Mitigation for CVE-2021-47980 includes upgrading to a patched version of Fuel CMS or implementing input validation to prevent SQL injection.
Does CVE-2021-47980 require authentication to exploit?
Yes, CVE-2021-47980 requires authentication, making it accessible only to authenticated users.