CVE-2020-17463

CVE-2020-17463 is a SQL injection flaw (CWE-89) in FUEL CMS 1.4.7, exploitable through the 'col' parameter on the /pages/items, /permissions/items, and /navigation/items endpoints. Because the parameter is not properly sanitized, a remote, unauthenticated attacker can inject arbitrary SQL via crafted HTTP requests to these URLs with no user interaction or privileges required. Successful exploitation can expose or alter the contents of the CMS database, and under some database configurations may enable further attacks against the backend. Any installation running FUEL CMS 1.4.7 is affected, with internet-exposed instances at greatest risk. The flaw carries a critical CVSS 3.1 score of 9.8, a top-percentile EPSS score (89.7% probability of exploitation within 30 days), a public proof-of-concept, and was added to CISA's Known Exploited Vulnerabilities Catalog on 2021-12-10, indicating known in-the-wild exploitation; ransomware association is unknown.

What to do: Upgrade FUEL CMS to a release newer than 1.4.7 per the vendor's instructions, as required by the CISA KEV catalog entry. If patching is not immediate, restrict or filter the 'col' parameter on /pages/items, /permissions/items, and /navigation/items (e.g., via WAF rules) and confirm the CMS database account follows least-privilege principles. Review web and database logs for anomalous queries or SQL injection payloads targeting these endpoints, and verify internet-exposed instances are patched given the KEV listing and high EPSS score.