Fuel CMS Blind SQL Injection Vulnerability in Activity Log

A blind SQL injection vulnerability has been identified in Fuel CMS version 1.4.13. This vulnerability allows authenticated attackers to inject SQL code through the 'col' parameter in the Activity Log interface, manipulating database queries and extracting information based on response time delays.

Impact

Exploitation of this vulnerability allows for blind SQL injection, where an attacker can manipulate database queries and potentially extract sensitive information from the database.

Reproduction

To reproduce this vulnerability, log into the Fuel CMS admin panel and navigate to the 'Activity Log' menu. Select any type option, and the 'col' parameter will be vulnerable. Inject a SQL payload, such as a sleep command, into the 'col' parameter to create a delay in the response, indicating successful exploitation.