The FuelCMS application by Daylight Studio version 1.5.2 contains a SQL injection flaw in the Login.php controller. The vulnerability allows an attacker who can send a specially crafted HTTP request to the login endpoint to inject arbitrary SQL statements into the backend database query. Successful exploitation can read, modify, or delete data, compromising the confidentiality, integrity, and availability of the CMS content and user information.

The affected product is Daylight Studio FuelCMS, release 1.5.2, as identified by the CPE string cpe:2.3:a:thedaylightstudio:fuel_cms:1.5.2. No other vendors, products, or versions are listed in the advisory, so the risk applies only to this single version.

The CVSS base score of 7.7 indicates high severity, while the EPSS probability of less than 1 % suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. It can be inferred that the attack vector is a web‑based request to the Login.php controller, typically by submitting injected input through the login form or related authentication fields. With network access to the affected web application, an attacker could execute arbitrary SQL commands, potentially leading to data exposure or modification.