A blind SQL injection vulnerability in FUEL CMS 1.4.13 allows authenticated attackers to potentially compromise database confidentiality.

This is a SQL injection vulnerability (CWE-89) triggered via the 'col' parameter. It requires an authenticated user to successfully execute the attack, as it involves manipulating database queries to extract information.

With a CVSS score of 7.1, this vulnerability poses a significant risk to data confidentiality. An attacker capable of exploiting this flaw can perform unauthorized database queries, potentially leading to the exposure of sensitive user data, system credentials, or configuration details stored within the CMS database.

Immediate Action: Review the vendor's security documentation for the latest available security patches or configuration hardening steps for FUEL CMS.

Proactive Monitoring: Monitor database query logs for suspicious syntax or unexpected patterns, particularly those originating from authenticated user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block SQL injection patterns in incoming HTTP requests.

Public Exploit Available: Yes, a proof-of-concept is available on ExploitDB (ID: 50523).

Given the availability of a public exploit and the potential for severe data compromise, users of FUEL CMS 1.4.13 must audit their installations and apply any available security patches immediately. If an official fix is unavailable, restrict administrative access to the CMS and apply strict WAF filtering to mitigate the risk of SQL injection.