Withdrawn Advisory: Daylight Studio FUEL-CMS SQLi Vulnerability

HIGH 8.8CVE-2020-24950 · GHSA-7rvp-xqj7-rxf2 · Published 11/08/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
codeigniter/framework Packagist	`< 1.4.10`	`1.4.10`
fuel cms thedaylightstudio	`= 1.4.9`	No fix yet

Description

Withdrawn Advisory

This advisory has been withdrawn because this vulnerability does not affect a package in a supported ecosystem. This link has been maintained to preserve external references.

Original Description

SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.

NVD description

SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.

References

nvd.nist.gov/vuln/detail/CVE-2020-24950 · ADVISORY
daylightstudio/FUEL-CMS · WEB
daylightstudio/FUEL-CMS commit c8d9381 · WEB
daylightstudio/FUEL-CMS · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free