Exploit for CVE-2018-16763

kitploit · 2026-09-02

Description

Remote code execution in Fuel CMS 1.4.1 via Python 3.x.

Entry point

Parameterfilter · query param

Pathfuel/pages/select/

Fuel CMS 1.4.1 RCE via unsanitized filter parameter exploited in GET /fuel/pages/select/ with crafted payload leading to code execution.

Affected Thedaylightstudio Fuel Cms versions

Thedaylightstudio Fuel Cms≤ 1.4.2

All known vulnerabilities by product

CVSS 9.8 for CVE-2018-16763

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-09-02 20:23

Last Seen:2026-09-03 01:56

Reporter:KitPloit

Tags

Fuel CMSRemote code executionPython 3.xversion 1.4.1

Other exploits for CVE-2018-16763

CVE-2018-16763-exploit

2026-09-03 KitPloitKITPLOIT

2026-09-03 KitPloitKITPLOIT

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

2026-09-03 KitPloitKITPLOIT

CVE-2018-16763_fuel_cms_exploit

2026-09-02 KitPloitKITPLOIT

CVE-2018-16763-FuelCMS-1.4.1-RCE

2026-09-02 KitPloitKITPLOIT

2026-09-02 KitPloitKITPLOIT

CVE-2018-16763-FuelCMS-1.4.1-RCE

2026-09-02 KitPloitKITPLOIT

2026-09-02 KitPloitKITPLOIT

Exploit Code

MARKDOWN6 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-VITOBONETTI-CVE-2018-16763
# CVE-2018-16763

Fuel CMS 1.4.1 - Удаленное выполнение кода - Python 3.x

Оригинальный скрипт : Exploit-DB