Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2018-16763 — Python tool for analyzing CVE-2018-16763 in FUEL CMS with cleaner response parsing and interactive vulnerability checking. | Kitploit
Tools/GitHubGitHub/some-1hing/cve-2018-16763
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubsome-1hing/cve-2018-16763

CVE-2018-16763

Python tool for analyzing CVE-2018-16763 in FUEL CMS with cleaner response parsing and interactive vulnerability checking.

View Repository
133 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2018-16763 Analyzer

CVE-2018-16763 Analyzer is a small Python project for analyzing CVE-2018-16763 against FUEL CMS targets. It focuses on checking whether a target appears vulnerable and on displaying command output in a cleaner, more readable way when the application response is noisy.

This project is intentionally lightweight and interactive. It is meant to make testing and response parsing easier without turning the repository into a large framework.

According to the National Vulnerability Database, FUEL CMS 1.4.1 allows PHP code evaluation through the pages/select/ filter parameter or the preview/ data parameter, which can lead to pre-auth remote code execution. NVD assigns the issue a CVSS 3.1 score of 9.8 Critical.

Features

  • Vulnerability Check: Sends a simple validation request to determine whether the target appears vulnerable.
  • Cleaner Output Handling: Extracts command output from noisy FUEL CMS responses and removes repeated HTML/error clutter.
  • Interactive Command Loop: Lets you test commands one at a time after the vulnerability check succeeds.
  • Proxy Support: Supports optional Burp proxy routing for local debugging and traffic inspection.
  • Lightweight Setup: Only requires Python 3 and the requests library.

Table of Contents

  • Prerequisites
  • Installation
  • Usage
  • Example Output
  • How It Works
  • Security Considerations
  • License
  • Disclaimer

Prerequisites

Before using CVE-2018-16763 Analyzer, make sure the following is available on your machine:

  • Python 3
  • pip
  • Internet or lab network access to the target
  • Python package: requests

Install the dependency with:

root@kitploit:~
python3 -m pip install requests

Installation

To set up the project locally:

root@kitploit:~
git clone https://github.com/SOME-1HING/CVE-2018-16763.git
cd CVE-2018-16763
python3 -m pip install requests

If you use a different repository name, replace the clone URL and directory name accordingly.

Usage

Run the tool with:

root@kitploit:~
python3 cve_2018_16763.py

The script will ask for:

  • The target URL
  • Whether you want to route traffic through a Burp proxy

Example:

root@kitploit:~
   CVE-2018-16763 Analyzer

[+] Target URL: http://target-ip
[+] Use Burp proxy? (y/N):

If the target appears vulnerable, the tool will print a basic validation result and then drop into its interactive command loop.

Example Output

root@kitploit:~
[*] Checking target...

[+] Target is vulnerable

uid=33(www-data) gid=33(www-data) groups=33(www-data)

[+] Interactive shell
[+] Type exit to quit

cmd> whoami

============================================================
www-data
============================================================

How It Works

  • Target Validation: The script first sends a request built around the vulnerable FUEL CMS parameter and checks the response for signs of successful execution.
  • Encoded Payload Construction: User-supplied commands are URL-encoded and escaped before being inserted into the request.
  • Output Markers: Unique markers are wrapped around each command so the script can isolate the command output from surrounding response noise.
  • Response Cleanup: If marker extraction fails, the script falls back to HTML stripping and basic filtering of repeated PHP warning content.
  • Interactive Testing: After validation, commands are executed one at a time and displayed in a simple terminal-style loop.

Security Considerations

  • Authorized Use Only: Only use this project against systems you own or are explicitly authorized to assess.
  • No Stateful Session: Commands are executed independently, so stateful shell behavior such as persistent directory changes will not carry across commands.
  • Response Variability: Output may differ depending on the FUEL CMS version, PHP version, server setup, and the shell used by the target.
  • Keep Dependencies Updated: Make sure your local Python environment and packages are kept up to date.

License

This project is distributed under the MIT License. See LICENCE for details.

Disclaimer

CVE-2018-16763 Analyzer is provided for educational and defensive research purposes only.

The author and contributors are not liable for misuse, damage, downtime, data loss, legal consequences, or any other harm resulting from use of this repository, its code, or related ideas. This project is provided as-is, without warranty of any kind, express or implied.

By using this repository, you accept full responsibility for ensuring your actions are legal, authorized, and compliant with your rules of engagement, local law, contracts, and organizational policy.

Download Tool