Unauthenticated Arbitrary File Upload RCE in Astroid Framework for Joomla

Single-file Python exploit repository containing Astroid_rce.py, a threaded mass-exploitation script for CVE-2026-21628 targeting Astroid Framework installations associated with Joomla. The script is not a framework module; it is a standalone operational exploit. Its workflow is: normalize target URLs from an input file, probe common Joomla deployment subpaths, request /administrator/ to extract a CSRF token, then POST to /administrator/index.php with com_ajax Astroid media upload parameters to upload a PHP webshell disguised as an SVG/image payload. The embedded payload writes/executes as yoru.php and exposes host fingerprinting via php_uname() plus a secondary file-upload capability for follow-on access. The code supports mass targeting with ThreadPoolExecutor, disables TLS verification, uses custom browser-like headers and AJAX headers, iterates through multiple candidate upload directories, and saves successful shell URLs to shells.txt. Notable observables include the vulnerable AJAX endpoint, common probed subpaths, upload directory candidates, the shell filename yoru.php, and hardcoded Telegram/GitHub URLs used for attribution or auxiliary resources.

Repository contains a single Python exploit script and a minimal promotional README. The main file, CVE-2026-21628.py, is a multithreaded operational exploit targeting an alleged unauthenticated RCE in the Astroid Framework, with strong indicators it is aimed at Joomla-based deployments. The script disables SSL verification, supports single-target or bulk target input, deduplicates targets, and scans multiple likely Joomla installation subpaths. It defines two embedded PHP webshell payloads: a basic uploader shell and a bypass variant that attempts several server-side file-write methods for resilience. The exploit logic is structured around trying multiple upload directories, including traversal-like values such as images/.., media/.., and templates/.., to land executable PHP content in web-accessible locations such as the webroot or administrator directory. It uses a marker string (Devco1) to confirm successful execution and writes successful results to upload.txt. The code uses requests, urllib3, threading, and ThreadPoolExecutor for concurrent exploitation at scale. Overall, this is not a detector; it is an active exploitation tool intended to achieve unauthenticated webshell deployment and persistent remote access via HTTP(S).