{"vulnerability": "CVE-2018-19146", "sightings": [{"uuid": "0cc92753-4d90-43ee-814a-54e7182c0859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19146", "type": "seen", "source": "https://t.me/hacking_Attack/27119", "content": "KitPloit - PenTest Tools!\nFUSE - A Penetration Testing Tool For Finding File Upload Bugs\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhqamkOtMsV-aRAr4_S9CfR5DGaxCzwhGuVGrbw2PCFmAHQzWsLeYRCZRLhO3sWirSajYzf3r1g-RluL3zxSIBwQzfQysM7hYs00ZSJ_KacbMvljgwgjIeCR71e0O_GixRKuC0gmHPHjKpFtpkbouiwLVpkz7qmdTWxYrTjwwGrxuOpgWPGT8HO348H-Q=w640-h340 FUSE is a penetration testing system designed to identify Unrestricted  Executable File Upload (UEFU) vulnerabilities. The details of the testing  strategy is in our paper,  \"FUSE: Finding File Upload Bugs via Penetration Testing\", which appeared in  NDSS 2020. To see how to configure and execute FUSE, see the followings. SetupInstallFUSE currently works on Ubuntu 18.04 and Python 2.7.15.\n\n1. Install dependencies # apt-get install rabbitmq-server\n# apt-get install python-pip\n# apt-get install git 1. Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE\n$ cd FUSE && pip install -r requirements.txt * If you plan to leverage headless browser verification using selenium, please  install Chrome and Firefox web driver by refering selenium  document. UsageConfiguration* \nFUSE uses a user-provided configuration file  that specifies parameters for a target PHP application. The script must be  filled out before testing a target Web application. You can check out README file and example configuration files.\n\n* \nConfiguration for File Monitor (Optional) $ vim filemonitor.py\n\n...\n10 MONITOR_PATH='/var/www/html/' <-\n11 MONITOR_PORT=20174 <-\n12 EVENT_LIST_LIMITATION=8000 <-\n... Execution* FUSE $ python framework.py [Path of configuration file] * File Monitor $ python filemonitor.py * Result \n* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.\n* A [HOST] folder stores files that have been attempted to upload.\n* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU. CVEsIf you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md\nApplication CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001 AuthorThis research project has been conducted by WSP Lab at KAIST.\n\n* Taekjin Lee\n* Seongil Wi\n* Suyoung Lee\n* Sooel Son Citing FUSETo cite our paper:\n\nDistributed System Security Symposium},      year = 2020  }  \">@INPROCEEDINGS{lee:ndss:2020,\nauthor = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},\ntitle = {{FUSE}: Finding File Upload Bugs via Penetration Testing},\nbooktitle = {Proceedings of the Network and Distributed System Security Symposium},\nyear = 2020\n}  Download FUSE\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:17.135991Z"}, {"uuid": "99e19fed-839b-452a-9a08-b44f2e7639ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19146", "type": "seen", "source": "https://t.me/hacking_Attack/27117", "content": "FUSE is a penetration testing (https://www.kitploit.com/search/label/Penetration%20Testing) system designed to identify Unrestricted  Executable File Upload (UEFU) vulnerabilities. The details of the testing  strategy is in our  paper (https://wsp-lab.github.io/papers/lee-fuse-ndss20.pdf),  \"FUSE: Finding File Upload Bugs via Penetration Testing\", which appeared in  NDSS 2020. To see how to configure and execute FUSE, see the followings.  \nSetup\n  \nInstall\n  FUSE currently works on Ubuntu 18.04 and Python 2.7.15.    Install dependencies    # apt-get install rabbitmq-server\n# apt-get install python-pip\n# apt-get install git\n    Clone and build FUSE    $ git clone https://github.com/WSP-LAB/FUSE\n$ cd FUSE && pip install -r requirements.txt\n    If you plan to leverage headless (https://www.kitploit.com/search/label/Headless) browser verification using selenium, please  install Chrome and Firefox web driver by refering selenium  document (https://selenium.dev/selenium/docs/api/py/index.html).    \nUsage\n  \nConfiguration\n      FUSE uses a user-provided configuration file (https://github.com/WSP-LAB/FUSE/blob/master/configs/default-credential.conf)  that specifies parameters for a target PHP application. The script must be  filled out before testing a target Web application. You can check out  README (https://github.com/WSP-LAB/FUSE/blob/master/configs/README.md) file and example configuration files (https://github.com/WSP-LAB/FUSE/blob/master/configs).      Configuration for File Monitor (Optional)      $ vim filemonitor.py\n\n...\n 10 MONITOR_PATH='/var/www/html/' <- Web root of the target application\n 11 MONITOR_PORT=20174            <- Default port of File Monitor\n 12 EVENT_LIST_LIMITATION=8000    <- Maxium number of elements in EVENT_LIST\n...\n  \nExecution\n    FUSE    $ python framework.py [Path of configuration file]\n    File Monitor    $ python filemonitor.py\n    Result    When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.  A [HOST] folder stores files that have been attempted to upload.  A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.        \nCVEs\n  If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md (https://github.com/WSP-LAB/FUSE/blob/master/README.md)      Application  CVEs      Elgg  CVE-2018-19172      ECCube3  CVE-2018-18637      CMSMadeSimple  CVE-2018-19419, CVE-2018-18574      CMSimple  CVE-2018-19062      Concrete5  CVE-2018-19146      GetSimpleCMS  CVE-2018-19420, CVE-2018-19421      Subrion  CVE-2018-19422      OsCommerce2  CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966      Monstra  CVE-2018-6383, CVE-2018-18694      XE  XEVE-2019-001      \nAuthor\n  This research project (https://www.kitploit.com/search/label/Research%20Project) has been conducted by WSP Lab (https://wsp-lab.github.io/) at KAIST.    Taekjin Lee  Seongil Wi (https://seongil-wi.github.io/)  Suyoung Lee (https://leeswimming.com/)  Sooel Son (https://sites.google.com/site/ssonkaist/home)    \nCiting FUSE\n  To cite our paper:  Distributed System Security Symposium},      year = 2020  }  \">@INPROCEEDINGS{lee:ndss:2020,\n    author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},\n    title = {{FUSE}: Finding File Upload Bugs via Penetration Testing},\n    booktitle = {Proceedings of the Network and Distributed System Security Symposium},\n    year = 2020\n}\n  \n\nDownload FUSE (https://github.com/WSP-LAB/FUSE)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:17.504628Z"}, {"uuid": "9f77682b-a611-438c-b10e-7e326ca3e92d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19146", "type": "seen", "source": "https://t.me/hacking_Attack/29057", "content": "Kali Linux Tutorials\nFUSE : A Penetration Testing Tool For Finding File Upload Bugs\n\nFUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our\u00a0paper, \u201cFUSE: Finding File Upload Bugs via Penetration Testing\u201d, which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings.\n\nSetup\n\nInstall\n\nFUSE currently works on Ubuntu 18.04 and Python 2.7.15.\n\n* Install dependencies\n\n#apt-get install rabbitmq-server\n#apt-get install python-pip\n#apt-get install git\n\n* Clone and build FUSE\n\n$ git clone https://github.com/WSP-LAB/FUSE\n$ cd FUSE && pip install -r requirements.txt\n\nIf you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document.\n\nUsage\n\nConfiguration\n\n* FUSE uses a user-provided\u00a0configuration file\u00a0that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out\u00a0README\u00a0file and\u00a0example configuration files.\n* Configuration for File Monitor (Optional)\n\n$ vim filemonitor.py\n\u2026\n10 MONITOR_PATH=\u2019/var/www/html/\u2019 <-\n11 MONITOR_PORT=20174 <-\n12 EVENT_LIST_LIMITATION=8000 <-\n\u2026\n\nExecution\n\n* FUSE\n\n$ python framework.py [Path of configuration file]\n\nFile Monitor\n\n$ python filemonitor.py\n\n* Result\n* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.\n* A [HOST] folder stores files that have been attempted to upload.\n* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.\nCVEs\n\nIf you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for\u00a0README.md\nApplicationCVEsElggCVE-2018-19172ECCube3CVE-2018-18637CMSMadeSimpleCVE-2018-19419, CVE-2018-18574CMSimpleCVE-2018-19062Concrete5CVE-2018-19146GetSimpleCMSCVE-2018-19420, CVE-2018-19421SubrionCVE-2018-19422OsCommerce2CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966MonstraCVE-2018-6383, CVE-2018-18694XEXEVE-2019-001 \n\nDownload", "creation_timestamp": "2026-09-01T20:02:12.248327Z"}, {"uuid": "433524e8-888c-4238-8990-9840a5b2bae9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19146", "type": "seen", "source": "https://t.me/hacking_Attack/27123", "content": "FUSE - A Penetration Testing Tool For Finding File Upload Bugs\n\n FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, \"FUSE: Finding File Upload Bugs via Penetration Testing\", which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings. Setup Install FUSE currently works on Ubuntu 18.04 and Python 2.7.15. Install dependencies # apt-get install rabbitmq-server# apt-get install python-pip# apt-get install git Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE$ cd FUSE && pip install -r requirements.txt If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document. Usage Configuration FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files. Configuration for File Monitor (Optional) $ vim filemonitor.py... 10 MONITOR_PATH='/var/www/html/' <- Web root of the target application 11 MONITOR_PORT=20174 <- Default port of File Monitor 12 EVENT_LIST_LIMITATION=8000 <- Maxium number of elements in EVENT_LIST... Execution FUSE $ python framework.py Path of configuration file File Monitor $ python filemonitor.py Result When FUSE completes the penetration testing, a HOST directory and a HOST\\_report.txt file are created. A HOST folder stores files that have been attempted to upload. A HOST\\_report.txt file contains test results and information related to files that trigger U(E)FU. CVEs If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md Application CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001 Author This research project has been conducted by WSP Lab at KAIST. Taekjin Lee Seongil Wi Suyoung Lee Sooel Son Citing FUSE To cite our paper: Distributed System Security Symposium}, year = 2020 } \">@INPROCEEDINGS{lee:ndss:2020, author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son}, title = {{FUSE}: Finding File Upload Bugs via Penetration Testing}, booktitle = {Proceedings of the Network and Distributed System Security Symposium}, year = 2020} Download FUSE\nRead more...\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:15.746504Z"}, {"uuid": "e22f9de5-ba27-4d7f-993b-638f48ee922c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19146", "type": "seen", "source": "https://t.me/hacking_Attack/27117", "content": "FUSE is a penetration testing (https://www.kitploit.com/search/label/Penetration%20Testing) system designed to identify Unrestricted  Executable File Upload (UEFU) vulnerabilities. The details of the testing  strategy is in our  paper (https://wsp-lab.github.io/papers/lee-fuse-ndss20.pdf),  \"FUSE: Finding File Upload Bugs via Penetration Testing\", which appeared in  NDSS 2020. To see how to configure and execute FUSE, see the followings.  \nSetup\n  \nInstall\n  FUSE currently works on Ubuntu 18.04 and Python 2.7.15.    Install dependencies    # apt-get install rabbitmq-server\n# apt-get install python-pip\n# apt-get install git\n    Clone and build FUSE    $ git clone https://github.com/WSP-LAB/FUSE\n$ cd FUSE && pip install -r requirements.txt\n    If you plan to leverage headless (https://www.kitploit.com/search/label/Headless) browser verification using selenium, please  install Chrome and Firefox web driver by refering selenium  document (https://selenium.dev/selenium/docs/api/py/index.html).    \nUsage\n  \nConfiguration\n      FUSE uses a user-provided configuration file (https://github.com/WSP-LAB/FUSE/blob/master/configs/default-credential.conf)  that specifies parameters for a target PHP application. The script must be  filled out before testing a target Web application. You can check out  README (https://github.com/WSP-LAB/FUSE/blob/master/configs/README.md) file and example configuration files (https://github.com/WSP-LAB/FUSE/blob/master/configs).      Configuration for File Monitor (Optional)      $ vim filemonitor.py\n\n...\n 10 MONITOR_PATH='/var/www/html/' <- Web root of the target application\n 11 MONITOR_PORT=20174            <- Default port of File Monitor\n 12 EVENT_LIST_LIMITATION=8000    <- Maxium number of elements in EVENT_LIST\n...\n  \nExecution\n    FUSE    $ python framework.py [Path of configuration file]\n    File Monitor    $ python filemonitor.py\n    Result    When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.  A [HOST] folder stores files that have been attempted to upload.  A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.        \nCVEs\n  If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md (https://github.com/WSP-LAB/FUSE/blob/master/README.md)      Application  CVEs      Elgg  CVE-2018-19172      ECCube3  CVE-2018-18637      CMSMadeSimple  CVE-2018-19419, CVE-2018-18574      CMSimple  CVE-2018-19062      Concrete5  CVE-2018-19146      GetSimpleCMS  CVE-2018-19420, CVE-2018-19421      Subrion  CVE-2018-19422      OsCommerce2  CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966      Monstra  CVE-2018-6383, CVE-2018-18694      XE  XEVE-2019-001      \nAuthor\n  This research project (https://www.kitploit.com/search/label/Research%20Project) has been conducted by WSP Lab (https://wsp-lab.github.io/) at KAIST.    Taekjin Lee  Seongil Wi (https://seongil-wi.github.io/)  Suyoung Lee (https://leeswimming.com/)  Sooel Son (https://sites.google.com/site/ssonkaist/home)    \nCiting FUSE\n  To cite our paper:  Distributed System Security Symposium},      year = 2020  }  \">@INPROCEEDINGS{lee:ndss:2020,\n    author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},\n    title = {{FUSE}: Finding File Upload Bugs via Penetration Testing},\n    booktitle = {Proceedings of the Network and Distributed System Security Symposium},\n    year = 2020\n}\n  \n\nDownload FUSE (https://github.com/WSP-LAB/FUSE)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:45.374679Z"}, {"uuid": "3cf50825-f0b5-4a35-b0a1-4e0167e102d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19146", "type": "seen", "source": "https://t.me/hacking_Attack/29057", "content": "Kali Linux Tutorials\nFUSE : A Penetration Testing Tool For Finding File Upload Bugs\n\nFUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our\u00a0paper, \u201cFUSE: Finding File Upload Bugs via Penetration Testing\u201d, which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings.\n\nSetup\n\nInstall\n\nFUSE currently works on Ubuntu 18.04 and Python 2.7.15.\n\n* Install dependencies\n\n#apt-get install rabbitmq-server\n#apt-get install python-pip\n#apt-get install git\n\n* Clone and build FUSE\n\n$ git clone https://github.com/WSP-LAB/FUSE\n$ cd FUSE && pip install -r requirements.txt\n\nIf you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document.\n\nUsage\n\nConfiguration\n\n* FUSE uses a user-provided\u00a0configuration file\u00a0that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out\u00a0README\u00a0file and\u00a0example configuration files.\n* Configuration for File Monitor (Optional)\n\n$ vim filemonitor.py\n\u2026\n10 MONITOR_PATH=\u2019/var/www/html/\u2019 <-\n11 MONITOR_PORT=20174 <-\n12 EVENT_LIST_LIMITATION=8000 <-\n\u2026\n\nExecution\n\n* FUSE\n\n$ python framework.py [Path of configuration file]\n\nFile Monitor\n\n$ python filemonitor.py\n\n* Result\n* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.\n* A [HOST] folder stores files that have been attempted to upload.\n* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.\nCVEs\n\nIf you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for\u00a0README.md\nApplicationCVEsElggCVE-2018-19172ECCube3CVE-2018-18637CMSMadeSimpleCVE-2018-19419, CVE-2018-18574CMSimpleCVE-2018-19062Concrete5CVE-2018-19146GetSimpleCMSCVE-2018-19420, CVE-2018-19421SubrionCVE-2018-19422OsCommerce2CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966MonstraCVE-2018-6383, CVE-2018-18694XEXEVE-2019-001 \n\nDownload", "creation_timestamp": "2026-09-02T01:02:37.922203Z"}, {"uuid": "5c6f6395-c7a5-432a-b1de-5b65ac993874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19146", "type": "seen", "source": "https://t.me/hacking_Attack/27123", "content": "FUSE - A Penetration Testing Tool For Finding File Upload Bugs\n\n FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, \"FUSE: Finding File Upload Bugs via Penetration Testing\", which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings. Setup Install FUSE currently works on Ubuntu 18.04 and Python 2.7.15. Install dependencies # apt-get install rabbitmq-server# apt-get install python-pip# apt-get install git Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE$ cd FUSE && pip install -r requirements.txt If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document. Usage Configuration FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files. Configuration for File Monitor (Optional) $ vim filemonitor.py... 10 MONITOR_PATH='/var/www/html/' <- Web root of the target application 11 MONITOR_PORT=20174 <- Default port of File Monitor 12 EVENT_LIST_LIMITATION=8000 <- Maxium number of elements in EVENT_LIST... Execution FUSE $ python framework.py Path of configuration file File Monitor $ python filemonitor.py Result When FUSE completes the penetration testing, a HOST directory and a HOST\\_report.txt file are created. A HOST folder stores files that have been attempted to upload. A HOST\\_report.txt file contains test results and information related to files that trigger U(E)FU. CVEs If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md Application CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001 Author This research project has been conducted by WSP Lab at KAIST. Taekjin Lee Seongil Wi Suyoung Lee Sooel Son Citing FUSE To cite our paper: Distributed System Security Symposium}, year = 2020 } \">@INPROCEEDINGS{lee:ndss:2020, author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son}, title = {{FUSE}: Finding File Upload Bugs via Penetration Testing}, booktitle = {Proceedings of the Network and Distributed System Security Symposium}, year = 2020} Download FUSE\nRead more...\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:43.056017Z"}, {"uuid": "fae7a19b-1cfb-4755-9c4e-a5415ad5e321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-19146", "type": "seen", "source": "https://t.me/hacking_Attack/27119", "content": "KitPloit - PenTest Tools!\nFUSE - A Penetration Testing Tool For Finding File Upload Bugs\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhqamkOtMsV-aRAr4_S9CfR5DGaxCzwhGuVGrbw2PCFmAHQzWsLeYRCZRLhO3sWirSajYzf3r1g-RluL3zxSIBwQzfQysM7hYs00ZSJ_KacbMvljgwgjIeCR71e0O_GixRKuC0gmHPHjKpFtpkbouiwLVpkz7qmdTWxYrTjwwGrxuOpgWPGT8HO348H-Q=w640-h340 FUSE is a penetration testing system designed to identify Unrestricted  Executable File Upload (UEFU) vulnerabilities. The details of the testing  strategy is in our paper,  \"FUSE: Finding File Upload Bugs via Penetration Testing\", which appeared in  NDSS 2020. To see how to configure and execute FUSE, see the followings. SetupInstallFUSE currently works on Ubuntu 18.04 and Python 2.7.15.\n\n1. Install dependencies # apt-get install rabbitmq-server\n# apt-get install python-pip\n# apt-get install git 1. Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE\n$ cd FUSE && pip install -r requirements.txt * If you plan to leverage headless browser verification using selenium, please  install Chrome and Firefox web driver by refering selenium  document. UsageConfiguration* \nFUSE uses a user-provided configuration file  that specifies parameters for a target PHP application. The script must be  filled out before testing a target Web application. You can check out README file and example configuration files.\n\n* \nConfiguration for File Monitor (Optional) $ vim filemonitor.py\n\n...\n10 MONITOR_PATH='/var/www/html/' <-\n11 MONITOR_PORT=20174 <-\n12 EVENT_LIST_LIMITATION=8000 <-\n... Execution* FUSE $ python framework.py [Path of configuration file] * File Monitor $ python filemonitor.py * Result \n* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.\n* A [HOST] folder stores files that have been attempted to upload.\n* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU. CVEsIf you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md\nApplication CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001 AuthorThis research project has been conducted by WSP Lab at KAIST.\n\n* Taekjin Lee\n* Seongil Wi\n* Suyoung Lee\n* Sooel Son Citing FUSETo cite our paper:\n\nDistributed System Security Symposium},      year = 2020  }  \">@INPROCEEDINGS{lee:ndss:2020,\nauthor = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},\ntitle = {{FUSE}: Finding File Upload Bugs via Penetration Testing},\nbooktitle = {Proceedings of the Network and Distributed System Security Symposium},\nyear = 2020\n}  Download FUSE\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:45.058772Z"}]}