# CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.

- Page: https://www.vulneraibility.com/cve/CVE-2018-16763
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 82.94% (percentile 99.7)
- Public exploit code: 3 on Exploit-DB · 24 GitHub proofs of concept · 1 Nuclei template (first 2019-07-19)
- Published: 2018-09-09

## Affected

- thedaylightstudio:fuel_cms

## References

- [other] https://github.com/daylightstudio/FUEL-CMS/issues/478
- [other] https://0xd0ff9.wordpress.com/2019/07/19/from-code-evaluation-to-pre-auth-remote-code-execution-cve-2018-16763-bypass/
- [exploit] https://www.exploit-db.com/exploits/47138
- [other] http://packetstormsecurity.com/files/153696/fuelCMS-1.4.1-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/160080/Fuel-CMS-1.4-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/164756/Fuel-CMS-1.4.1-Remote-Code-Execution.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.