Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE_2018_16763_Proof_of_Concept — A Proof-of-Concept (PoC) exploit for CVE-2018-16763 (Fuel CMS - Preauthenticated Remote Code Execution). | Kitploit
Tools/GitHubGitHub/saccles/cve_2018_16763_proof_of_concept
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationLabs & Practice
GitHubsaccles/cve_2018_16763_proof_of_concept

CVE_2018_16763_Proof_of_Concept

A Proof-of-Concept (PoC) exploit for CVE-2018-16763 (Fuel CMS - Preauthenticated Remote Code Execution).

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2018-16763 Proof-of-Concept

A Proof-of-Concept (PoC) exploit for CVE-2018-16763 (Fuel CMS - Preauthenticated Remote Code Execution).

Description

This Python 3 program serves as a PoC for the CVE-2018-16763 vulnerability in the Fuel CMS content management system. Specifically, the vulnerability allows for PHP Code Evaluation through the pages/select/filter parameter (implemented in this PoC), leading to Preauthenticated Remote Code Execution, a critical system vulnerability.

Getting Started

Dependencies

  • Python 3 and the Python Standard Library
  • The Open Source Git Version Control System
  • Other Python Packages/Modules (see requirements.txt for more details)
  • Command Prompt, PowerShell, Terminal, or some other Command Line Interface (CLI)
  • A Windows, Linux, Unix, or macOS Operating System

Installation

  1. Download the git repository.
root@kitploit:~
git clone https://github.com/saccles/CVE-2018-16763-Proof-of-Concept.git
  1. Enter the git repository.
root@kitploit:~
cd CVE-2018-16763-Proof-of-Concept
  1. Install the required packages and other dependencies.
root@kitploit:~
python3 -m pip install -r requirements.txt

Program Execution

Run the exploit script against a vulnerable target. (ONLY RUN THE SCRIPT AGAINST A TARGET YOU OWN OR A TARGET PROVIDED BY TryHackMe, HackTheBox, OR ANOTHER ETHICAL HACKING WEBSITE!) I would recommend checking out TryHackMe's "Ignite" Challenge for more details. You can also download the vulnerable Fuel CMS application from exploit-db.com.

root@kitploit:~
python3 CVE-2018-16763.py -u URL
[DEBUG] Connecting to http://10.10.60.46 ...
[DEBUG] Succesfully connected!

Enter Command:
$ ls -la
total 52
drwxrwxrwx 4 root root  4096 Jul 26  2019 .
drwxr-xr-x 3 root root  4096 Jul 26  2019 ..
-rw-r--r-- 1 root root   163 Jul 26  2019 .htaccess
-rwxrwxrwx 1 root root  1427 Jul 26  2019 README.md
drwxrwxrwx 9 root root  4096 Jul 26  2019 assets
-rwxrwxrwx 1 root root   193 Jul 26  2019 composer.json
-rwxrwxrwx 1 root root  6502 Jul 26  2019 contributing.md
drwxrwxrwx 9 root root  4096 Jul 26  2019 fuel
-rwxrwxrwx 1 root root 11802 Jul 26  2019 index.php
-rwxrwxrwx 1 root root    30 Jul 26  2019 robots.txt

Help

  • Are all of the dependencies present? If there are issues with conflicting dependencies, consider using a Python 3 virtual environment (https://docs.python.org/3/library/index.html).
  • Is the target up?
  • Is the target running Fuel CMS 1.4.1 or another version that is impacted by CVE-2018-16763?
root@kitploit:~
python3 CVE-2018-16763.py -h
usage: CVE-2018-16763.py [-h] -u URL

This tool exploits CVE-2018-16763 on Fuel CMS.

options:
-h, --help         show this help message and exit
-u URL, --url URL  Fuel CMS url.

Authors

Silas Accles [saccles]

Version History

  • 0.1
    • Initial Release

License

This project is licensed under the MIT License - see the LICENSE.md file for details.

Acknowledgments

Heavily inspired by Exploit-DB programs, Vozec's PoC scripts, and the original PoC developed by Padsala Trushal.

  • Exploit-DB
  • Vozec
  • Padsala Trushal
Download Tool