Unauthenticated Arbitrary File Upload RCE in Joomla Page Builder CK

This repository is a small standalone mass-exploitation tool consisting of one Python 2 script and a README. The main file, CVE-2026-56290.py, reads a list of target URLs, normalizes them, and processes them concurrently with a multiprocessing pool (15 workers by default). For each target, it first performs a GET request to the base URL and attempts to extract a CSRF token from the returned HTML using several regex patterns. If a token is found, it constructs a Joomla component upload request to /index.php?option=com_pagebuilderck&task=browse.ajaxAddPicture&<token>=1 and submits a multipart upload containing a hardcoded PHP web shell. The script tries several executable extensions (.php, .PHP, .phar, .phtml) and sets the destination folder to media/com_pagebuilderck/gfonts/. If the JSON response contains an uploaded file path, it requests that path directly to verify shell deployment by checking for marker strings in the response. Confirmed shell URLs are printed and appended to reslt.txt. The exploit’s main capability is unauthenticated or weakly protected remote code execution via arbitrary file upload in the com_pagebuilderck Joomla component. The embedded payload is not just a marker; it is an operational PHP web shell that reveals system information via php_uname() and exposes an additional upload form for post-exploitation file placement. The repository does not include framework metadata or modularization; it is a direct-purpose offensive script intended for bulk scanning and exploitation rather than detection only. The README mirrors the script behavior, documents usage, and lists IOC paths and request patterns defenders can monitor.

Repository contains two Python programs and a README. The main exploit file, exploit.py, is an obfuscated loader that performs integrity checks on itself, base64-decodes and XOR/zlib-decompresses an embedded blob, then execs the recovered Python source in memory. Because the actual exploit logic is embedded and not visible in plaintext, direct code-level extraction of request parameters beyond the wrapper is limited. However, the README clearly documents the exploit chain: obtain a Joomla CSRF token, POST to Joomla index.php using option=com_pagebuilderck&task=fonts.save, cause the target to fetch a remote font.css/payload, write a PHP shell to media/com_pagebuilderck/gfonts/fbi.php, and confirm RCE by checking for a page title containing 'Fbi Shell'. This indicates a web-based RCE exploit against Page Builder CK for Joomla, mapped in the repository to CVE-2026-56290. The second code file, scanner.py, is a plaintext threaded detection utility rather than an exploit. It probes /components/com_pagebuilderck/assets/pagebuilderck.js over HTTP/HTTPS, checks for JavaScript content containing Page Builder CK signatures, and writes discovered targets to pagebuilderck_found.txt. It supports bulk input, URL normalization, retries, custom headers, and concurrent scanning. Overall, the repository purpose is twofold: identify Joomla sites running the target component and exploit vulnerable instances to deploy a PHP web shell. The exploit is operational because it is intended to achieve code execution with a concrete shell path and verification logic, though the payload details are hardcoded and the main exploit source is obfuscated rather than modular.

Repository contains a standalone Python exploit for CVE-2026-56290 targeting the Joomla Page Builder CK extension (com_pagebuilderck). Structure is minimal: one main Python script (cve_2026_56290.py), a README with operational details, a banner SVG, and requirements.txt listing requests/urllib3. The Python script is the clear entry point and implements a mass-exploitation workflow rather than a simple detector. Core capability: unauthenticated arbitrary file upload leading to remote code execution. The exploit targets the confirmed task/controller method browse.ajaxAddPicture and uses the confirmed parameter names file and path, while also bruteforcing alternate task and parameter names for resilience. It normalizes target URLs, fingerprints Joomla/Page Builder CK, attempts version discovery, harvests CSRF tokens from public pages, and then uploads a PHP shell/backdoor into attacker-chosen writable directories. The code includes many destination paths under media/com_pagebuilderck and common Joomla writable folders, plus traversal-style alternatives. It also includes numerous PHP extension variants and double-extension tricks to bypass filtering. Operational features visible from the code and README include multithreading (ThreadPoolExecutor), mass target processing, live TXT output, JSON reporting, optional known-endpoint mode, shell validation, optional cleanup, and likely follow-on upload through the deployed shell. This makes it more than a proof-of-concept but still a standalone script with a basic hardcoded payload model, so OPERATIONAL is the best fit. Attack surface is primarily web/network based. Fingerprintable target artifacts include the Joomla manifest path /administrator/manifests/files/com_pagebuilderck.xml, the vulnerable task name browse.ajaxAddPicture, upload parameter names, and a broad set of writable destination directories. Overall, the repository’s purpose is to automate reconnaissance, exploitation, validation, and reporting for vulnerable Joomla Page Builder CK instances at scale.