CVE-2020-17463 Fuel CMS SQL Injection

Exploited in the wild Critical 9.8 Published 13 Aug 2020 Updated 21 Oct 2025

Attackers can inject SQL commands via the col parameter in FUEL CMS to read or modify database contents.

Exploited in the wild: Since 10 Dec 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-17463?

CVE-2020-17463 is a critical SQL injection vulnerability in n/a, published on 13 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

Weakness: CWE-89

Which versions are affected by CVE-2020-17463?

It affects 1 product.

Products include Thedaylightstudio Fuel Cms.

How do I fix CVE-2020-17463?

No fix has been published for CVE-2020-17463 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Jun 2022.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2020-17463 being exploited?

Yes. Attackers have exploited CVE-2020-17463 in the wild since at least 10 Dec 2021.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-h5p3-6ppq-r5h3.