CVE-2018-16763 PoC — FUEL CMS 注入漏洞

Source

Associated Vulnerability

Title:FUEL CMS 注入漏洞 (CVE-2018-16763)
Description:FUEL CMS是一款基于Codelgniter框架的内容管理系统（CMS）。 FUEL CMS 1.4.1版本中的pages/select/页面的‘filter’参数和preview/页面的‘data’参数存在注入漏洞。该漏洞源于用户输入构造命令、数据结构或记录的操作过程中，网络系统或产品缺乏对用户输入数据的正确验证，未过滤或未正确过滤掉其中的特殊元素，导致系统或产品产生解析或解释方式错误。

Description

Rust implementation of CVE-2018-16763 with some extra features.

Readme

```
________ ___  ___  ________  ___               ________  _____  ___   _________  ________  ________
|\  _____\\  \|\  \|\_____  \|\  \             |\  _____\/ __  \|\  \ |\___   ___\\_____  \|\   __  \
\ \  \__/\ \  \\\  \|____|\ /\ \  \            \ \  \__/|\/_|\  \ \  \\|___ \  \_\|____|\ /\ \  \|\  \
 \ \   __\\ \  \\\  \    \|\  \ \  \            \ \   __\|/ \ \  \ \  \    \ \  \      \|\  \ \   _  _\
  \ \  \_| \ \  \\\  \  __\_\  \ \  \____        \ \  \_|    \ \  \ \  \____\ \  \    __\_\  \ \  \\  \|
   \ \__\   \ \_______\|\_______\ \_______\       \ \__\      \ \__\ \_______\ \__\  |\_______\ \__\\ _\
    \|__|    \|_______|\|_______|\|_______|        \|__|       \|__|\|_______|\|__|  \|_______|\|__|\|__|
```

A rust implementation of [CVE 2018-16763](https://nvd.nist.gov/vuln/detail/CVE-2018-16763) with some extra features.

### How to run
You'll need to either build it or grab a release version from [here](https://gitlab.com/pretzelca/fu3lf1lt3r/-/releases).

The command syntax is as follows:   
`fu3lf1lt3r <target> [file url]`   
If you supply a file url, Fu3l F1lt3r will automatically download that file and execute it on the target, otherwise it will open a live shell.

### Building
Fu3l F1lt3r compiles using the latest Rust stable, just run `cargo build` and it should compile.

### Previews

Live Shell:
[![Fu3l F1lt3r Live Shell](https://res.cloudinary.com/marcomontalbano/image/upload/v1592812937/video_to_markdown/images/youtube--ha7Co1092bc-c05b58ac6eb4c4700831b2b3070cd403.jpg)](https://youtu.be/ha7Co1092bc "Fu3l F1lt3r Live Shell")

Auto-Run:
[![Fu3l F1lt3r Auto-Run](https://res.cloudinary.com/marcomontalbano/image/upload/v1592813047/video_to_markdown/images/youtube--CaOYWn-fmcE-c05b58ac6eb4c4700831b2b3070cd403.jpg)](https://youtu.be/CaOYWn-fmcE "Fu3l F1lt3r Auto-Run")

File Snapshot


 [4.0K]  /data/pocs/030d8c4388f0194043493e2715fd3a4a78cc5a3b
├── [ 31K]  Cargo.lock
├── [ 405]  Cargo.toml
├── [4.0K]  doc
│   └── [2.8K]  README.html
├── [ 34K]  LICENSE
├── [1.8K]  README.md
└── [4.0K]  src
    ├── [ 498]  color_macro.rs
    ├── [1.4K]  cool_text.rs
    └── [4.6K]  main.rs

2 directories, 8 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!