Unauthenticated RCE in Joomla JCE profile import

This repository contains a single Python exploit script, Joomla_jce.py, implementing an unauthenticated mass exploitation workflow for an alleged Joomla JCE Extension RCE identified in the code comments as CVE-2026-48907. The script is not a framework module; it is a standalone threaded exploiter intended to process a list of targets from a user-supplied file. Operational flow: the script normalizes each target to HTTPS, checks the root page for availability, extracts a 32-character CSRF token from either a JavaScript csrf.token field or a hidden input, then submits a multipart POST request to /index.php?option=com_jce with task=profiles.import and a file field named profile_file. The uploaded content is a PHP webshell disguised with MIME type application/xml. After upload, the script assumes the file becomes reachable under /tmp/<random>.php and verifies success by requesting that URL and checking for a hardcoded marker string. Main exploit capability: arbitrary file upload leading to remote PHP code execution. Post-exploitation capability is limited but practical: the dropped shell reveals php_uname() output and provides a browser-based file upload form, enabling an operator to upload additional tooling or payloads. Successful shell URLs are appended to shells.txt. Repository structure is minimal: one executable Python file with helper functions for banner display, session creation, shell verification, exploitation, and main threaded orchestration. No auxiliary modules, documentation, or detection-only logic are present. The code uses requests, urllib3, colorama, regex parsing, and ThreadPoolExecutor with 120 worker threads for mass scanning/exploitation. Overall, this is an operational mass web exploit script with a hardcoded payload rather than a mere proof of concept.

Small standalone exploit repository centered on a single Python script, `CVE-2026-48907.py`, plus documentation and license files. The Python script is the operational entry point and implements an unauthenticated web RCE workflow against Joomla sites running a vulnerable JCE Editor component. Based on the visible code and README, the exploit first probes JCE-related endpoints to identify likely exposure, then attempts to create a new editor profile with permissive upload settings that allow PHP extensions. It subsequently uploads a PHP web shell and uses that shell to execute attacker-supplied commands, including a one-shot command mode and an interactive mode. Repository structure is simple: one code file, one README with bilingual explanation and usage examples, a license, and a `.gitignore`. No framework integration is present; this is a standalone Python exploit using `requests`, `urllib3`, and standard library modules. The script accepts a target URL, optional proxy, verbosity, custom profile name, shell output filename, and mode flags such as `--check`, `--exploit`, `--interactive`, and `-c/--command`. Main exploit capabilities: - Detect likely JCE exposure by requesting known component/profile endpoints. - Create a malicious JCE editor profile via `task=profile.save`. - Relax upload restrictions to permit PHP-family extensions. - Upload a PHP shell to the target. - Execute arbitrary OS commands through the uploaded shell. - Support proxying and verbose logging for operator convenience. This is not merely a detector: it contains exploitation logic and a post-exploitation command-execution path. Because the payload is a basic uploaded PHP shell rather than a highly modular framework payload, the maturity is best classified as OPERATIONAL.

Repository contains two files: a standalone Python exploit (CVE-2026-48907.py) and a Nuclei template (n.yaml). Because this repository includes a framework template, the main exploit logic is best represented by the Nuclei file, but the Python script provides fuller operational detail. The target is Joomla with the JCE extension vulnerable to CVE-2026-48907, described as unauthenticated RCE via profile import and arbitrary file upload. The Python script is a multithreaded scanner/exploit. It reads a target list, fingerprints JCE by requesting known JCE files, fetches a CSRF token from the Joomla homepage, imports a crafted JCE profile that enables dangerous file types and disables MIME validation, then uploads a PHP payload through JCE's browser RPC endpoint. It tests execution by requesting the uploaded file under /images/ with a command parameter and records successful shell URLs to webshell.txt. Payloads are simple PHP webshells using either backticks or system($_GET["x"]). The Nuclei template performs a similar chain in a more compact form: GET / to extract a CSRF token, POST to /index.php?option=com_jce with multipart data, then GET /tmp/{{tmp_file}} to confirm PHP execution by checking for the result of 45*69. That template is effectively an exploitation/verification template rather than mere passive detection, since it attempts to write and execute a PHP file. Overall purpose: unauthenticated exploitation of vulnerable JCE installations to achieve remote code execution. Main capabilities include target fingerprinting, CSRF token extraction, malicious profile import, arbitrary PHP upload, execution verification, and persistence of successful shell URLs.

Repository contains a single Python exploit script and a README. The main file, CVE-2026-48907.py, is a multithreaded unauthenticated Joomla JCE RCE scanner/exploit. Its workflow is: normalize target URLs, fingerprint likely JCE installations using three known JCE-related paths, request the site root to extract a 32-hex CSRF token from page content, submit a crafted XML JCE profile import that enables dangerous upload behavior, upload one of several PHP command-execution payloads through the JCE browser RPC endpoint, and verify code execution by requesting an uploaded shell under /images/ with the x parameter set to echo RCEOK. Confirmed shell URLs are written to webshell.txt. The script supports batch scanning from a targets file, configurable thread count and timeout, and an interactive CLI mode. This is not merely a detector: it actively attempts exploitation and persistence via an uploaded webshell. The README is generic and incomplete, while the Python code clearly targets Joomla sites with the JCE extension/component and aims to achieve remote command execution over HTTP.

This repository is a small educational exploit lab for CVE-2026-48907, an unauthenticated RCE affecting the JCE Joomla extension. It is not an automated exploit framework; instead, it provides a vulnerable Dockerized environment plus manual exploitation steps and a minimal payload. The repository contains four files: a README describing the vulnerability and exploitation flow, a docker-compose.yml that deploys Joomla 5.3.1 with MySQL 8.0, an instructions.txt file repeating the attack steps, and shell.xml.php containing the actual PHP webshell payload. The exploit capability is straightforward: obtain a CSRF token and session cookie from the Joomla front page, submit a multipart POST to the JCE endpoint index.php?option=com_jce with task=profiles.import and profile_file=@shell.xml.php;type=application/xml, then invoke the uploaded file from /tmp/shell.xml.php with a cmd parameter. The payload uses PHP system() to execute arbitrary OS commands, so successful exploitation yields unauthenticated command execution as the web server user (example output shows www-data). Repository structure and purpose: docker-compose.yml is for lab deployment only and exposes Joomla on port 8080 with a backend MySQL container. README.md and instructions.txt document setup, vulnerable JCE package download, token extraction, upload, and verification. shell.xml.php is the only real exploit payload file. Overall, this is an operational proof-of-concept lab demonstrating manual exploitation of a web upload-to-RCE chain against vulnerable JCE installations.

Repository contains a README and a single Python exploit script. The README describes CVE-2026-48907 as an unauthenticated RCE in the Joomla JCE extension caused by improper access control in profile management, affecting versions 1.0.0 through 2.9.99.4. The operational logic is entirely in exploit.py. The exploit script defines a JCEExploit class that automates a full attack chain: it requests the target base URL to scrape a 32-hex-character CSRF token using several regex patterns; it then POSTs to /index.php?option=com_jce with task=profiles.import and a multipart file field named profile_file containing a PHP payload disguised as an XML/PHP file (jce-<random>.xml.php). If the response suggests success, the script assumes the file is written under /tmp/ and then accesses /tmp/<filename> with a cmd query parameter to execute arbitrary system commands through PHP system(). Capabilities include vulnerability exploitation, malicious file upload, webshell deployment, command execution, validation of shell access using 'echo JCE_TEST', one-shot command execution via --cmd, and an interactive pseudo-shell via --interactive. The script supports optional HTTP/HTTPS proxying and verbose logging, disables TLS certificate verification, and uses a requests session for stateful interaction. Fingerprintable targets and paths are straightforward: the target homepage / for token extraction, /index.php?option=com_jce for the vulnerable import action, and /tmp/<random>.xml.php for the resulting webshell. The exploit is a real offensive exploit rather than a detector, and because it includes a hardcoded but functional PHP webshell payload, its maturity is best classified as OPERATIONAL rather than a bare POC.

This repository is a small, single-purpose Python exploit/scanner for CVE-2026-48907 affecting Joomla! sites running the JCE Editor component before 2.9.99.5. The repo contains three files: a detailed README, the main exploit implementation in exploit.py, and a minimal requirements.txt for optional UI/reporting dependencies. The core capability is intrusive vulnerability verification rather than passive detection. The script fingerprints Joomla and JCE, checks version indicators, attempts to extract a Joomla CSRF token, and then tries exploitation using at least two web-based paths described in the README: a multipart upload vector using the profile_file field to place a PHP file in /tmp/, and a secondary browser/RPC upload-and-rename chain. For confirmed exploitation, it uploads a PHP proof file named in a masta-*.xml.php style, then performs an HTTP GET to the uploaded file and validates execution by searching for an RXST:<base64>:RXEND wrapper containing MATHOK:{expected}. This is a clear RCE confirmation workflow. The exploit is implemented as a standalone Python 3 script using urllib/http.cookiejar/ssl from the standard library rather than requests. It includes session handling, multipart body construction, optional proxy support, disabled SSL verification by default, concurrency via ThreadPoolExecutor for bulk scanning, terminal formatting, and optional Excel report generation through openpyxl. Optional rich integration improves console output, but the exploit logic does not depend on third-party packages. Operationally, this is more than a simple detector: it performs live upload and execution checks against the target. However, the payload is fixed and benign, so maturity is best classified as OPERATIONAL rather than weaponized. No obvious destructive or fake behavior is present. The main fingerprintable target paths visible from the provided content are the site root /, JCE-related artifacts such as jce.xml, the upload destination /tmp/, and the proof URL pattern /tmp/masta-{rand}.xml.php. The repository’s purpose is authorized security assessment of Joomla/JCE deployments with high-confidence confirmation of unauthenticated RCE.

Repository contains a single Python exploit script (main.py) and a README. The script is a standalone Joomla JCE exploitation utility for CVE-2026-48907, supporting both safe scanning and active exploitation. Its workflow, as described in the README and reflected in the code structure, is: fingerprint JCE by requesting several known JCE files/paths; extract the installed version from jce.xml when available; obtain a Joomla CSRF token from site content; exploit the unauthenticated profile import capability to create a malicious JCE profile that enables PHP upload and weakens validation; upload one of several embedded PHP webshell payloads through JCE browser/upload functionality; then verify and report a reachable shell URL. The script uses requests.Session with optional HTTP/HTTPS proxying, disables TLS verification warnings, and supports single-target or multi-target threaded scanning via argparse and ThreadPoolExecutor. Notable capabilities include version detection, mass scanning, proxy support, output logging, and multiple payload variants intended to bypass upload restrictions. This is not merely a detector: it contains operational exploit logic and hardcoded PHP command-execution payloads, making it an operational exploit rather than a simple proof of concept.

This repository is a small single-purpose exploit/scanner project consisting of one substantial Python file, a README, and optional dependency list. The main file, masta-cve-2026-48907.py, is a standalone threaded scanner for CVE-2026-48907 affecting Joomla! sites running the JCE Editor component before 2.9.99.5. The code is not just passive detection: it performs intrusive exploitation attempts to confirm unauthenticated RCE. Its workflow, as described in the README and supported by visible code, is: normalize targets, fingerprint Joomla!, fingerprint JCE, compare versions, extract a CSRF token if needed, then attempt upload-based exploitation. The payload generator (_make_verify_payload) creates a PHP file containing a benign verification echo. The response checker (_check_execution) looks for an RXST/base64/RXEND wrapper and validates the decoded MATHOK marker. This indicates the exploit confirms server-side PHP execution rather than only checking version strings. Repository structure is simple: README.md documents usage and scanner logic; requirements.txt lists optional rich/openpyxl dependencies; .gitignore excludes Python artifacts and generated reports; masta-cve-2026-48907.py contains all scanning, HTTP session handling, multipart form construction, concurrency, terminal output, and report generation logic. The script uses Python stdlib networking (urllib, cookiejar, ssl) and supports proxying, disabled SSL verification by default, multithreaded bulk scans, and Excel reporting when openpyxl is installed. Main exploit capabilities include: Joomla/JCE fingerprinting, version-based assessment, WAF detection, multipart file upload, alternate browser-chain upload/rename logic, retrieval of uploaded PHP proof files from temporary web paths, and classification of results into statuses such as VULNERABLE, VULNERABLE_UPLOAD_ONLY, PATCHED, SAFE, BLOCKED_BY_WAF, and NOT_JOOMLA. The exploit is best characterized as an operational intrusive scanner with a hardcoded verification payload rather than a generalized post-exploitation framework.

Repository contains a small exploit PoC set for an unauthenticated Joomla JCE file-upload-to-RCE issue labeled CVE-2026-48907. There are 5 files total: one Python exploit script, one Nuclei template, a README, license, and .gitignore. The Python script is the main operational exploit: it accepts either a single URL or a file of targets, reads an operator-supplied local payload file, fetches the target homepage to extract a CSRF token, submits a multipart POST to `/index.php?option=com_jce` with `task=profiles.import`, uploads the payload as a randomly named `.xml.php` file, and then requests `/tmp/<filename>` to confirm successful upload and likely code execution. This makes it a real exploit rather than a detector, because it performs the upload and can deliver arbitrary PHP content. The Nuclei YAML is a framework-based verification template that follows the same three-step flow: GET `/` to extract `csrf.token`, POST the upload with a fixed PHP expression payload, then GET `/tmp/{{tmp_file}}` and match on output `3105`. Because the repository includes a Nuclei template, it belongs to a framework, but the repo also includes standalone exploit code. The exploit capability is arbitrary unauthenticated file upload leading to remote code execution on vulnerable JCE installations. Fingerprintable targets are the Joomla root page, the JCE import endpoint `/index.php?option=com_jce`, and the uploaded file path under `/tmp/`. The README largely documents usage and provides example PHP payloads such as a command web shell and eval backdoor, reinforcing that the intended post-exploitation result is attacker-controlled PHP execution.

The repository contains a single Python exploit script, ssi4.py, presented as an all-in-one exploit for CVE-2026-48907 affecting Joomla/JCE. It is not part of a larger framework. The script is operational rather than a simple PoC: it supports single-target or bulk-target processing, URL normalization and extraction from files/stdin, multithreaded execution via ThreadPoolExecutor, colored console output, result logging, and multiple exploitation modes. Core purpose: identify Joomla sites with JCE-related components, probe likely vulnerable endpoints, obtain CSRF-style tokens from several front-end and administrator paths, attempt exploitation through JCE task endpoints, and write a server-side shell into common writable web directories. It then verifies successful code execution and records either full RCE or file-write-only outcomes. Notable exploit capabilities inferred from the code: - Fingerprinting JCE presence using known static paths such as /plugins/editors/jce/jce.xml and /administrator/components/com_jce/jce.xml. - Probing JCE application endpoints including /index.php?option=com_jce&task=cpanel and /index.php?option=com_jce&task=profiles.import. - Collecting CSRF tokens from multiple public/admin pages using regex patterns for csrf.token and hidden input fields. - Trying alternate headers (X-Forwarded-For and X-Real-IP set to 127.0.0.1) to work around simple WAF or access controls. - Dropping either a PHP webshell or an SSI-based shell into tmp/, cache/, or administrator/cache/ using various executable extensions (.php, .phtml, .php3, .php7, .php5, .phar, .pht) and .shtml for SSI. - Verifying command execution using id and regex matching for uid=... gid=... output. - Distinguishing between successful RCE and write-only conditions, then saving results to output files. Payload details: - The PHP payload is a minimal passthru-based webshell that executes commands supplied via cmd and uses id for validation. - The SSI payload is an HTML/SSI command terminal labeled 'SSInjection Terminal' that executes commands from the query string and renders output in a styled browser interface. Repository structure is minimal: one standalone Python file with helper routines for target loading, URL parsing, WAF heuristics, version/patch checks, payload generation, scanning/exploitation orchestration, and a main() entry point. Overall, this is a bulk-capable web exploitation tool aimed at turning a JCE file-write/RCE condition into persistent webshell access.

This repository is a small, single-purpose exploit PoC for CVE-2026-48907 affecting the JCE editor extension for Joomla. It contains two files: a README describing the vulnerability at a high level and a Python script, poc.py, which performs the exploit flow. The script is the main entry point and uses the requests Session API to maintain cookies across requests. Operationally, the exploit takes one argument: a target base URL. It then reads a local PHP payload file named alfa.php from the current directory. Next, it sends a GET request to the target root path to scrape a CSRF token using one of two regex patterns. With that token, it submits a multipart POST request to /index.php?option=com_jce with task=profiles.import and uploads the local alfa.php content as profile_file. After a short delay, it attempts to access /tmp/alfa.php on the target to verify upload success and trigger execution. The exploit’s main capability is unauthenticated arbitrary PHP upload followed by remote execution, assuming the vulnerable JCE import functionality is exposed and the uploaded file lands in a web-accessible, executable temporary directory. This is more than a pure detector because it actively uploads and executes attacker-controlled code. The payload itself is not embedded in the repository; instead, the operator supplies it via alfa.php, making the exploit operational but basic rather than framework-grade. There are no external C2 servers, hardcoded IPs, or third-party network services referenced beyond the operator-supplied target URL and the target-local Joomla/JCE endpoints.

This repository is a collection of multiple independent CVE-2026-48907 PoCs targeting unauthenticated remote code execution in the Joomla JCE component, rather than a single cohesive exploit project. It contains three Python exploit/scanner variants and one educational lab-oriented PoC with Docker environments. The main exploit capability across the Python scripts is consistent: fingerprint JCE by requesting known plugin/component files, fetch a CSRF token from the public Joomla homepage, abuse the unauthenticated JCE profile import feature at /index.php?option=com_jce to loosen upload restrictions or stage attacker-controlled content, upload a PHP payload through JCE browser/plugin RPC or via profile import staging, and finally verify code execution by requesting the uploaded file over HTTP. Successful exploitation yields a reachable PHP webshell URL and arbitrary command execution via HTTP parameters. The 0xBlackash sample is a straightforward mass scanner/uploader that writes confirmed shells to webshell.txt. The 87achrafg-stack and webshellseo8 variants are more feature-rich OPERATIONAL scanners with multiple payload encodings, GIF-header bypass attempts, extra JCE checks, and in one case a custom upload-capable PHP shell. The ywh-jfellus subtree is more educational and self-contained. It includes poc.py plus vulnerable/ and patched/ Docker Compose labs. That PoC demonstrates a slightly different exploitation path: the imported profile file is staged into Joomla's web-accessible tmp/ directory as an .xml.php file, then fetched from /tmp/ to confirm PHP execution. The lab binds Joomla to 127.0.0.1:9999 and installs either JCE 2.9.99.4 (vulnerable) or 2.9.99.5 (patched) via GitHub release ZIP URLs in custom entrypoint scripts. Notable repository quality observations: one README (87achrafg-stack) appears mismatched and describes a different WordPress-related CVE, but the Python file itself still targets JCE/Joomla. Despite some truncation in the provided content, the available code clearly implements real exploitation logic rather than mere detection. Overall, this is an exploit repository with mass-scanning and webshell-deployment functionality for CVE-2026-48907, plus a reproducible local lab for validation and patch comparison.

Repository contains a single Python exploit script and a README. The Python file is a multithreaded mass scanner/exploit for a claimed Joomla JCE unauthenticated RCE, labeled CVE-2026-48907. Its workflow is: normalize target URLs, fingerprint JCE-related files, probe a JCE endpoint, fetch the site root to extract a CSRF token, then attempt an import/upload/rename chain to place a PHP webshell. It uses several PHP payload variants, including minimal command-execution shells and GIF89a-prefixed payloads intended to bypass content-type or magic-byte checks. Successful exploitation is validated by actual PHP execution, and confirmed shell URLs are written to webshell.txt. The code is operational rather than a simple detector because it includes upload and execution payloads, concurrency support, output handling, and confirmation logic. The repository README is inconsistent with the code: it describes a different CVE and WordPress /wp-json behavior, suggesting the README is copied or unrelated. Based on the available code, the real purpose of the repository is Joomla/JCE webshell deployment and RCE verification across multiple targets.

This repository is a small educational exploit lab for CVE-2026-48907, an unauthenticated RCE affecting Joomla Content Editor (JCE) up to 2.9.99.4. The main exploit logic is in poc.py, a Python script using requests.Session to interact with a Joomla instance. It first fetches the site root to extract a CSRF token from page content, then submits a multipart POST to /index.php?option=com_jce with task=profiles.import and an uploaded file named like cve-2026-48907-XXXX.xml.php. The uploaded content is a minimal PHP payload (<?= 45*69 ?>). After a short delay, the script requests /tmp/<filename> and checks whether the server executed the PHP code, confirming RCE. The exploit capability is straightforward but real: unauthenticated remote upload through JCE profile import followed by direct execution from the Joomla tmp directory. The PoC does not provide an interactive shell or post-exploitation tooling; it is a verification exploit that demonstrates arbitrary PHP execution with a hardcoded payload. Repository structure is simple: README.md explains the vulnerability and usage; poc.py is the exploit; vulnerable/ and patched/ each contain a docker-compose.yaml and entrypoint.sh to build comparison labs. The vulnerable lab installs JCE 2.9.99.4, while the patched lab installs 2.9.99.5. Both labs expose Joomla on 127.0.0.1:9999 and use MariaDB as a backend. The entrypoint scripts are largely Joomla container setup logic, with the notable difference being the JCE package URL installed at the end. Overall, this is a legitimate operational PoC repository intended to validate whether a target Joomla/JCE deployment is exploitable under the specific condition that PHP execution from the web-accessible tmp/ directory is allowed.

Repository contains a single Python exploit script and a short README. The main file, CVE-2026-48907.py, is an operational mass scanner/exploit for an alleged unauthenticated RCE in Joomla's JCE component. It is not framework-based. The script accepts a target list, uses multithreading, normalizes targets to HTTPS if no scheme is provided, and scans each host for JCE indicators using several known component/plugin file paths. It then checks a JCE endpoint (/index.php?option=com_jce&task=cpanel.feed), retrieves a Joomla CSRF token from the homepage, and attempts to import a crafted JCE profile that enables permissive upload settings including php/gif file types, disabled MIME validation, and rename capability. After that, it tries multiple PHP webshell payload variants, including GIF89a-prefixed payloads for content-type or magic-byte bypasses, to achieve code execution. The exploit's stated goal is to save only confirmed RCE results, meaning it verifies that uploaded PHP actually executes before recording the resulting shell URL to webshell.txt. Overall, this is a real exploit-oriented mass exploitation tool rather than a detector: it fingerprints targets, modifies JCE configuration through profile import, uploads a webshell, and confirms arbitrary command execution over HTTP.