The vulnerability is a blind SQL injection in the ‘col’ parameter of the Activity Log endpoint, allowing an authenticated attacker to inject SQL and control database queries. By sending specially crafted payloads that create measurable delays, the attacker can extract sensitive information such as table names, column names, and data values. The flaw stems from improper input validation, classified as CWE‑89, and enables an attacker to read data from the database without visible output.

Getfuelcms Fuel CMS version 1.4.13. No other versions are listed as vulnerable, and the product is specifically identified by this version.

The CVSS v3.1 score of 7.1 indicates a medium‑to‑high severity, and because the attack requires authentication, it is less exploitable than a public flaw but still concerning. EPSS data is not available, so the likelihood of exploitation cannot be quantified at this time. The vulnerability is not included in CISA’s KEV catalog. The attack vector is internal; an attacker with legitimate user credentials can leverage the vulnerable endpoint to perform blind data extraction.