Unauthenticated RCE in JoomShaper SP Page Builder

Repository contains a single Python exploit script (poc.py), a target list (site.txt), and a license. The script is a multithreaded bulk exploitation tool aimed at Joomla sites running SP Page Builder. It constructs a ZIP archive that looks like a custom icon/font package by including selection.json, style.css, and a dummy TTF file, then adds a malicious PHP file under fonts/shxt.php or fonts/shxt.PHP. The script POSTs this archive to the Joomla endpoint /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon using the form field custom_icon. If the upload succeeds, it derives the expected public shell location under /media/com_sppagebuilder/assets/iconfont/<random_icon_name>/fonts/ and performs a GET request to verify execution by checking for the marker string 'Shinday'. The embedded PHP payload is a simple web shell/file uploader that reveals system information via php_uname() and allows arbitrary file upload to the server. The script supports bulk target processing from a text file, defaults to 20 threads, disables TLS verification, and writes successful shell URLs to result.txt. site.txt appears to be a large list of candidate targets rather than code. Overall, this is an operational arbitrary file upload to web-shell deployment exploit, not merely a detector.

This repository is a small standalone exploit project with 2 files: a Python 2 exploit script and a README. The main file, CVE-2026-48908.py, is a multithreaded mass-exploitation tool targeting CVE-2026-48908 in the Joomla SP Page Builder component. It is not a framework module. The script reads target URLs from a file, normalizes each URL to the vulnerable endpoint /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon, and submits a crafted ZIP archive using the multipart field custom_icon. The ZIP is built to resemble a valid icon-font package by including selection.json, style.css, and a dummy TTF file, while also embedding a PHP web shell at fonts/shxt.php or fonts/shxt.PHP. After upload, the script derives the expected extraction path under /media/com_sppagebuilder/assets/iconfont/<random_name>/fonts/ and performs an HTTP GET to verify that the shell is reachable and functional. Successful shell URLs are appended to result.txt. The embedded payload is a basic PHP web shell that prints system information via php_uname() and exposes a file-upload form for additional file placement. Overall, this is an operational unauthenticated web RCE exploit with a hardcoded payload, intended for bulk scanning and exploitation of vulnerable SP Page Builder installations.

This repository is a compact Python proof-of-concept exploit for CVE-2026-48908 affecting JoomShaper SP Page Builder (com_sppagebuilder) on Joomla. The repository contains one executable code file (sppb_rce.py), a README with detailed vulnerability and usage notes, a requirements file listing requests, and a license. The exploit is not part of a larger framework. The main capability is unauthenticated remote code execution via the web endpoint index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon. The script crafts a valid icon-font ZIP archive containing expected files such as selection.json, style.css, and fonts/<name>.ttf so the upload is accepted, then adds a PHP web shell into the fonts/ directory. It posts the archive using multipart field custom_icon and relies on the vulnerable component extracting the ZIP into the public path media/com_sppagebuilder/assets/iconfont/<name>/. The exploit is adaptive. It first attempts direct shell uploads using multiple PHP-related extensions: php, php3, php4, php5, php7, pht, phtml, phar, PHP, pHp, and Php. If direct execution fails, it falls back to uploading fonts/.htaccess with AddType application/x-httpd-php .PHP plus an uppercase .PHP shell, attempting to bypass case-sensitive extension filters and force Apache to execute the payload where AllowOverride is enabled. After each upload, it requests the uploaded shell over HTTP with GET parameters t and c to verify execution using a marker command. If successful, it can run a single command, provide an interactive pseudo-shell, or just confirm the vulnerability. If uploads succeed but code does not execute, it reports partial vulnerability (file write only). If the server returns the string indicating admin access is required, it treats the target as patched. The payload is a token-guarded PHP web shell that executes arbitrary system commands via system() only when the correct token is supplied; otherwise it returns 404. The script also supports cleanup by issuing a shell command through the web shell to remove all created iconfont directories. Overall, this is a real operational exploit PoC for unauthenticated arbitrary file upload leading to RCE on vulnerable SP Page Builder deployments, with built-in verification, multiple extension bypass attempts, and artifact cleanup.

Repository is a small standalone Python exploit PoC for CVE-2026-48908 affecting SP Page Builder (com_sppagebuilder) on Joomla. Structure is minimal: README.md documents the vulnerability, usage, and exploitation logic; exploit_poc.py contains the full exploit and mass-scan workflow; requirements.txt lists requests and frint. The exploit is not part of a major framework. Core capability: unauthenticated arbitrary file upload leading to RCE. The script crafts a ZIP that resembles a valid SP Page Builder icon-font package by including selection.json, style.css, and a dummy TTF file, then embeds either a built-in token-guarded PHP webshell or a user-supplied custom shell under fonts/. It POSTs this archive to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon. If accepted, the component extracts the archive under media/com_sppagebuilder/assets/iconfont/<random>/fonts/, making the shell web-accessible. Execution logic: the built-in shell executes system($_GET['c']) only when GET parameter t matches the chosen token; otherwise it returns 404. The script then requests the uploaded shell and verifies execution using echo SPPB-RCE-$((7*6)), expecting SPPB-RCE-42 in the response. It iterates through multiple PHP-related extensions (.php, .php3, .php4, .php5, .php7, .pht, .phtml, .phar, and mixed/uppercase variants) to bypass extension filtering. If direct extensions fail, it attempts an .htaccess bypass by uploading fonts/.htaccess with AddType application/x-httpd-php .PHP and a .PHP payload, relying on Apache override behavior. Operational features: supports single-target exploitation, probe-only mode (--check), mass scanning from a hosts file with configurable threading, quiet mode, custom token selection, and custom shell upload mode. It categorizes results into RCE, not vulnerable, write-only/partial, and custom-shell cases, then writes summary artifacts to vulnerable_hosts.txt, not_vulnerable_hosts.txt, partial_vulnerable_hosts.txt, custom_shell_hosts.txt, and scan_results.json. Notable implementation detail: upload() includes tolerant parsing for malformed/non-JSON server responses by locating the first '{' and decoding from there, improving robustness against noisy responses. Overall, this is a real exploit PoC with practical automation for exploitation and scanning, not merely a detector.

This repository is a small, focused exploit PoC consisting of one Python exploit script and one README. The main file, CVE-2026-48908.py, targets CVE-2026-48908, described as an unauthenticated arbitrary file upload leading to RCE in the SP Page Builder Joomla component via the task asset.uploadCustomIcon endpoint. The script is a real exploit, not merely a detector: it programmatically builds a malicious ZIP archive that imitates an IcoMoon icon package, uploads it to the vulnerable endpoint, and attempts to place a PHP webshell into the component’s iconfont directory. Exploit flow: the script normalizes the target URL, creates a requests session with a custom user-agent, generates random names for the icon package and shell, and builds a ZIP containing selection.json, style.css, a fake TTF file, and the PHP payload. It first tries direct upload of a .php shell. If that fails, it retries with a .PHP shell plus a fonts/.htaccess file containing an AddType directive to coerce Apache into executing the uppercase extension. After upload, it parses the JSON response to recover the resulting iconfont directory, constructs the expected shell path, and verifies RCE by requesting the shell with a secret token and a benign echo command. On success, it prints the shell URL and can either execute a single command or enter an interactive shell loop. The payload is a simple PHP webshell gated by a token parameter t. If the token matches, it executes arbitrary system commands supplied via GET parameter c or cmd. This makes the exploit operational rather than a bare PoC, because it provides immediate post-exploitation command execution. A cleanup option is also present; it issues a remote rm -rf command against the uploaded directory as a best-effort removal step. Repository structure is minimal: README.md documents the claimed vulnerability, affected versions (1.0.0 through 6.6.1), impact, and mitigation, while the Python script contains all exploit logic. No external framework is used. The attack vector is web/network-based, and the key fingerprintable target is the Joomla endpoint index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon along with the upload directory media/com_sppagebuilder/assets/iconfont.

This repository is a small standalone Go exploit project for CVE-2026-48908 targeting the Joomla SP Page Builder component (com_sppagebuilder) up to version 6.6.1. The repository contains only three files: a large .gitignore, a README with usage and vulnerability description, and a single Go source file, poc_tot.go, which is the full exploit implementation and likely sole executable entry point. The exploit is not part of a larger framework. It is an operational standalone tool that automates unauthenticated remote code execution by abusing the SP Page Builder asset upload endpoint index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon. The code constructs malicious ZIP archives intended for extraction into the web-accessible media/com_sppagebuilder/assets/iconfont directory or related writable paths. The README and visible code indicate multiple upload/execution strategies: direct PHP extension attempts, directory traversal, archive manipulation, and extension spoofing/case variation. The presence of an Apache .htaccess payload with AddType application/x-httpd-php .PHP suggests the exploit also tries to coerce execution of nonstandard or uppercase PHP extensions. The embedded payload is a minimal PHP webshell generated in buildZip(). It checks a token passed in GET parameter t and, if matched, executes the command from GET parameter c using system(). Otherwise it returns HTTP 404 to reduce visibility. After successful upload and extraction, the Go client verifies code execution, prints the resulting shell URL, supports one-shot command execution, offers an interactive shell mode, and can attempt cleanup of uploaded artifacts and created directories. Notable implementation details visible in the code include URL normalization, a custom HTTP client with TLS verification disabled (InsecureSkipVerify: true), redirect handling, random artifact naming, ZIP creation, and command/result handling. Based on the README and code fragments, the tool supports check mode for vulnerability confirmation, shell mode for interactive command execution, and cleanup mode for artifact removal. Overall, this is a real exploit rather than a detector: its purpose is to achieve unauthenticated RCE on vulnerable Joomla SP Page Builder deployments by planting and invoking a PHP webshell through the vulnerable icon upload/extraction workflow.

Repository contains a Python proof-of-concept exploit for CVE-2026-48908 affecting SP Page Builder for Joomla. Structure is minimal: README.md documents the vulnerability and usage, exploit_poc.py implements the exploit logic, and requirements.txt lists dependencies (requests, frint). The exploit is a real unauthenticated RCE tool, not just a detector. It targets the com_sppagebuilder asset.uploadCustomIcon task by uploading a crafted ZIP masquerading as an icon-font package. The ZIP includes expected files such as selection.json, style.css, and a dummy TTF, plus a PHP payload placed under fonts/. After upload, the script derives the extracted path under /media/com_sppagebuilder/assets/iconfont/<random>/fonts/ and attempts to access the uploaded shell directly over HTTP. Core capabilities: - Single-target exploitation via URL. - Mass scanning from a hosts file with multithreading. - Probe/check mode without command execution. - Automatic testing of multiple PHP-capable extensions: php, php3, php4, php5, php7, pht, phtml, phar, PHP, pHp, Php. - Fallback .htaccess bypass that writes fonts/.htaccess with 'AddType application/x-httpd-php .PHP' to force execution of uppercase .PHP files when the application filter is case-sensitive. - Built-in token-guarded PHP webshell that executes arbitrary commands from GET parameter c when token t matches. - Optional upload of a custom operator-supplied PHP shell instead of the built-in payload. - Result classification into RCE, write-only/partial, custom-shell upload, or not vulnerable, with output persisted to multiple text files and scan_results.json. The code uses requests with TLS verification disabled, normalizes targets to HTTPS by default, and handles malformed/non-JSON server responses by extracting JSON from raw response text. Successful exploitation yields a reachable webshell URL and arbitrary command execution on the remote server. If upload succeeds but PHP execution is blocked in /media, the script reports the host as partially vulnerable (file write only).

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-48908 affecting JoomShaper SP Page Builder (com_sppagebuilder) on Joomla. Repository structure is minimal: README.md documents the vulnerability and usage, requirements.txt lists the single dependency (requests), and sppb_rce.py is the only code file and clear entry point. The exploit targets the unauthenticated upload controller task index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon. It crafts an in-memory ZIP archive that mimics a valid icon-font package by including selection.json, style.css, and a dummy TTF file. It then adds two malicious files under the fonts/ subdirectory: a .htaccess file containing 'AddType application/x-httpd-php .PHP' and an uppercase-extension PHP web shell. This is designed to bypass a case-sensitive extension blocklist that rejects lowercase .php but allows .PHP and .htaccess, then rely on Apache override behavior to execute the uploaded .PHP file. Operational flow in sppb_rce.py: normalize target URL, generate random directory and shell names plus a per-run token, build the ZIP payload, POST it unauthenticated as multipart field custom_icon to the vulnerable task, parse the JSON response to recover the extracted iconfont directory, and then invoke the uploaded shell over HTTP GET with parameters t (token) and c (command). The script confirms RCE by executing 'echo SPPB-RCE-$((7*6))' and checking for 'SPPB-RCE-42'. It supports three main modes: check-only confirmation, one-shot command execution (default command id), and an interactive pseudo-shell. An optional cleanup mode attempts to remove the uploaded payload directory by issuing a shell command through the web shell. Main exploit capabilities: unauthenticated arbitrary file upload to a web-served directory, remote code execution via uploaded PHP web shell, arbitrary command execution, interactive shell-like access, and artifact cleanup. The exploit is not merely a detector; it contains a working payload and execution logic, but it is still a standalone PoC rather than a framework-integrated or highly modular weaponized tool.