Leerinao

The issue allows remote attackers to run arbitrary code via post ID to the "/users/delete/2" API endpoint. This is a Cross Site Request Forgery vulnerability.

The issue allows remote attackers to run arbitrary code via post ID to the "/permissions/delete/2" API endpoint. This is a Cross Site Request Forgery vulnerability.

An issue was discovered in FUEL CMS, where an attacker can use a XSS payload and bypass a filter via the "/fuelCM/fuel/pages/edit/1?lang=english" API endpoint.

Name of the Vulnerable Software and Affected Versions: FUEL CMS version 1.4.7 Description: An issue was discovered that allows for escalation of privilege to obtain super admin privilege. This is achieved via the `id` and `fuel id` parameters. Recommendations: For FUEL CMS version 1.4.7, as a temporary workaround, consider restricting access to the parameters `id` and `fuel id` until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.