CVE-2021-38727

moderate-risk
Published 2021-09-09

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items

Do I need to act?

~
1.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Thedaylightstudio

References (6)

Exploit https://github.com/daylightstudio/FUEL-CMS/issues/582
Broken Link https://streamable.com/lxw3ln
Broken Link https://www.nu11secur1ty.com/2021/10/cve-2021-38727.html
Exploit https://github.com/daylightstudio/FUEL-CMS/issues/582
Broken Link https://streamable.com/lxw3ln
Broken Link https://www.nu11secur1ty.com/2021/10/cve-2021-38727.html
41
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 4/34 · Minimal
Exposure 5/34 · Minimal