CVE-2020-17463: FUEL CMS SQL injection via col parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote SQL injection with a CVSS score of 9.8, KEV listing, a public exploit, and very high EPSS probability.

What it is

FUEL CMS 1.4.7 fails to sanitize the col parameter on the /pages/items, /permissions/items, and /navigation/items endpoints, allowing SQL injection. Because the flaw is remotely reachable without authentication, it exposes the CMS database to direct manipulation.

Impact

An attacker can read, modify, or delete arbitrary database contents, including CMS user and permission records, and may pivot to further compromise of the host.

Attack surface

Reached over the network through HTTP requests to the affected /items endpoints; the CVSS vector shows no privileges or user interaction required.

Exploitation

CISA added it to KEV in December 2021, an exploit is published on Packet Storm, and EPSS gives roughly 90 percent 30-day exploitation probability; no ransomware use is documented.

What to do

• Upgrade FUEL CMS to 1.4.8 or later, which the vendor release notes cover.
• If upgrade is not immediate, restrict access to the /pages/items, /permissions/items, and /navigation/items endpoints to trusted networks or authenticated administrators.
• Apply input validation or a WAF rule blocking SQL metacharacters in the col parameter.
• Review database and CMS admin accounts for unauthorized changes or additions.

Detection

• Inspect web logs for requests to /pages/items, /permissions/items, or /navigation/items containing SQL syntax in the col parameter.
• Alert on database errors or unusual query patterns originating from the web application.
• Monitor for unexpected changes to CMS users, permissions, or navigation records.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.