CVE-2018-16763_fuel_cms_exploit

⚠️ Disclaimer

This project is strictly for educational and ethical security research purposes only.
All activities were performed in a controlled lab / CTF environment.

Do not use the techniques described here on any system without proper authorization.

---

🎯 Objectives

• Identify potential attack vectors in FuelCMS
• Exploit web application vulnerability to gain code execution
• Perform post-exploitation enumeration
• Locate sensitive files and potential flags
• Understand system misconfigurations and privilege boundaries

---

🧠 Key Learnings

• Web application input handling weaknesses
• Command injection risk in CMS platforms
• Basic Linux post-exploitation enumeration techniques
• Importance of secure input sanitization
• Real-world behavior of web service accounts (e.g., www-data)

---

🧪 Methodology (High-Level)

1. Reconnaissance of the FuelCMS web application
2. Identification of a vulnerable input point
3. Execution of controlled command injection
4. System-level enumeration under limited user privileges
5. Search for sensitive files and configuration artifacts
6. Analysis of filesystem structure and application directories