# N/A
## 概述
FUEL CMS 1.4.1 中存在一个漏洞，攻击者可以通过 `pages/select/` 过滤参数或 `preview/` 数据参数执行任意PHP代码，进而实现未授权的远程代码执行。
## 影响版本
- FUEL CMS 1.4.1
## 细节
该漏洞允许攻击者通过以下两个参数执行任意PHP代码：
- `pages/select/` 过滤参数
- `preview/` 数据参数
## 影响
攻击者能够利用此漏洞在未授权的情况下执行任意PHP代码，从而导致远程代码执行问题。
是否为 Web 类漏洞： 是
判断理由：
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE 2018-16763 | https://github.com/dinhbaouit/CVE-2018-16763 | POC详情 |
| 2 | This is an updated version of the CVE-2018-16763 for fuelCMS 1.4.1 | https://github.com/hikarihacks/CVE-2018-16763-exploit | POC详情 |
| 3 | None | https://github.com/n3m1dotsys/CVE-2018-16763-Exploit-Python3 | POC详情 |
| 4 | Rust implementation of CVE-2018-16763 with some extra features. | https://github.com/uwueviee/Fu3l-F1lt3r | POC详情 |
| 5 | A working PoC to CVE-2018-16763 | https://github.com/shoamshilo/Fuel-CMS-Remote-Code-Execution-1.4--RCE-- | POC详情 |
| 6 | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. | https://github.com/kxisxr/Bash-Script-CVE-2018-16763 | POC详情 |
| 7 | Fuel CMS 1.4.1 - Remote Code Execution | https://github.com/padsalatushal/CVE-2018-16763 | POC详情 |
| 8 | A write up on the THM room Vulnerability Capstone & Exploit script for CVE-2018-16763. | https://github.com/wizardy0ga/THM-Vulnerability_Capstone-CVE-2018-16763 | POC详情 |
| 9 | None | https://github.com/crypticdante/CVE-2018-16763 | POC详情 |
| 10 | None | https://github.com/BrunoPincho/cve-2018-16763-rust | POC详情 |
| 11 | None | https://github.com/NaturalT314/CVE-2018-16763 | POC详情 |
| 12 | Exploit to trigger RCE for CVE-2018-16763 on FuelCMS <= 1.4.1 and interactive shell. | https://github.com/p0dalirius/CVE-2018-16763-FuelCMS-1.4.1-RCE | POC详情 |
| 13 | CVE-2018-16763 FuelCMS 1.4 Remote Code Execution, this version of FuelCMS is still vulnerable until now | https://github.com/not1cyyy/CVE-2018-16763 | POC详情 |
| 14 | None | https://github.com/antisecc/CVE-2018-16763 | POC详情 |
| 15 | Fuel CMS 1.4.1 - Remote Code Execution - Python 3.x | https://github.com/VitoBonetti/CVE-2018-16763 | POC详情 |
| 16 | None | https://github.com/H3xL00m/CVE-2018-16763 | POC详情 |
| 17 | None | https://github.com/n3ov4n1sh/CVE-2018-16763 | POC详情 |
| 18 | None | https://github.com/n3m1sys/CVE-2018-16763-Exploit-Python3 | POC详情 |
| 19 | None | https://github.com/c0d3cr4f73r/CVE-2018-16763 | POC详情 |
| 20 | None | https://github.com/Sp3c73rSh4d0w/CVE-2018-16763 | POC详情 |
| 21 | None | https://github.com/0xwh1pl4sh/CVE-2018-16763 | POC详情 |
| 22 | None | https://github.com/N3rdyN3xus/CVE-2018-16763 | POC详情 |
| 23 | None | https://github.com/Luigi31415/CVE-2018-16763 | POC详情 |
| 24 | None | https://github.com/NyxByt3/CVE-2018-16763 | POC详情 |
| 25 | None | https://github.com/h3xcr4ck3r/CVE-2018-16763 | POC详情 |
| 26 | None | https://github.com/n3rdh4x0r/CVE-2018-16763 | POC详情 |
| 27 | A Proof-of-Concept (PoC) exploit for CVE-2018-16763 (Fuel CMS - Preauthenticated Remote Code Execution). | https://github.com/saccles/CVE-2018-16763-Proof-of-Concept | POC详情 |
| 28 | Fuel CMS 1.4.1 - Remote Code Execution | https://github.com/altsun/CVE-2018-16763-FuelCMS-1.4.1-RCE | POC详情 |
| 29 | None | https://github.com/Kz0x-337/CVE-2018-16763 | POC详情 |
| 30 | A Proof-of-Concept (PoC) exploit for CVE-2018-16763 (Fuel CMS - Preauthenticated Remote Code Execution). | https://github.com/saccles/CVE_2018_16763_Proof_of_Concept | POC详情 |
| 31 | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16763.yaml | POC详情 |
| 32 | The goal of this project was to conduct a security audit of a blog recently launched by Ackme Support Incorporated, identifying any critical vulnerabilities before the site goes public. The task involved finding a way to remotely execute code and gain access to the target system. | https://github.com/ArtemCyberLab/Project-Exploiting-a-Vulnerability-in-Fuel-CMS-CVE-2018-16763- | POC详情 |
| 33 | None | https://github.com/h3x0v3rl0rd/CVE-2018-16763 | POC详情 |
| 34 | FuelCMS 1.4.1 Command Injection/Remote Code Execution. | https://github.com/B7T3/CVE-2018-16763_FuelCMS-1.4.1_RCE | POC详情 |
| 35 | exploit for CVE-2018-16763 | https://github.com/Cyberuser-hash/CVE-2018-16763 | POC详情 |
| 36 | Python3 exploit for Fuel CMS 1.4.1 Remote Code Execution (CVE-2018-16763) with Reverse Shell. | https://github.com/kaxm23/exploit_cms_fuel | POC详情 |
暂无评论