Fuel CMS SQL Injection Vulnerability

概要

参考情報

• packetstormsecurity.com/files/158840/Fuel-CMS-1.4.7-SQL-Injection.html · Exploit
• cwe.mitre.org/data/definitions/89.html · Technical Description
• getfuelcms.com · Vendor Advisory
• daylightstudio/FUEL-CMS · Third Party Advisory
• daylightstudio/FUEL-CMS release 1.4.8 · Release Notes
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2020-17463

fuel cms のその他の脆弱性

• CVE-2026-30459高 7.1An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset toke…
• CVE-2026-30461高 8.3Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Ins…
• CVE-2026-30460高 8.8Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.
• CVE-2026-30463高 7.7Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.
• CVE-2026-30458緊急 9.1An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.