CVE-2020-24950: Withdrawn Advisory: Daylight Studio FUEL-CMS SQLi Vulnerability

August 11, 2023 (updated July 2, 2025)

Withdrawn Advisory

This advisory has been withdrawn because this vulnerability does not affect a package in a supported ecosystem. This link has been maintained to preserve external references.

Original Description

SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.

References

github.com/advisories/GHSA-7rvp-xqj7-rxf2
github.com/daylightstudio/FUEL-CMS
github.com/daylightstudio/FUEL-CMS/commit/c8d9381d39b1c0f5488cf059ea9aa659ee227da4
github.com/daylightstudio/FUEL-CMS/issues/562
nvd.nist.gov/vuln/detail/CVE-2020-24950

Code Behaviors & Features

Detect and mitigate CVE-2020-24950 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →