> For the complete documentation index, see [llms.txt](https://shohamshilo.gitbook.io/shohamshilo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shohamshilo.gitbook.io/shohamshilo/projects-and-tools/fuel-cms-rce.md).

# Fuel CMS 1.4 RCE (CVE-2018-16763)

> 🐙 **Repo:** [Fuel-CMS-Remote-Code-Execution-1.4--RCE--](https://github.com/shoamshilo/Fuel-CMS-Remote-Code-Execution-1.4--RCE--) · **Language:** Python · **CVE:** [CVE-2018-16763](https://nvd.nist.gov/vuln/detail/CVE-2018-16763)

## Summary

A working proof-of-concept exploit, written in Python, for **CVE-2018-16763** — a remote code execution vulnerability in **Fuel CMS 1.4.1**. Reproducing a known CVE end-to-end is, in my experience, the single best way to actually understand a vulnerability class rather than just recognizing its name.

## The vulnerability (high level)

The flaw lives in how the affected version of Fuel CMS handles a user-controllable parameter that ultimately reaches a code-evaluation context. Insufficient filtering of that input allows an unauthenticated attacker to have server-side code evaluated i.e., remote code execution.

## What the PoC demonstrates

* Crafting a request that reaches the vulnerable parameter.
* Achieving server-side code execution and returning command output.
* A clean, readable Python implementation that's easy to follow and learn from.

## Remediation

* Upgrade Fuel CMS past the affected version.
* Never pass user-controlled input into code-evaluation functions.
* Apply strict allow-list input validation and proper output handling.

## Mapping

* **CWE:** CWE-94 (Code Injection)
* **MITRE ATT\&CK:** Exploitation of public-facing application (T1190)

***

➡️ More research: [Vulnerability Research](/shohamshilo/vulnerability-research/research.md)