Joomla! Extension 'iCagenda' 3.2.1 < 3.9.15 / 4.x < 4.0.8 Arbitrary Files Upload

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#

include('compat.inc');

if (description)
{
  script_id(330625);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id("CVE-2026-48939");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/07/13");

  script_name(english:"Joomla! Extension 'iCagenda' 3.2.1 < 3.9.15 / 4.x < 4.0.8 Arbitrary Files Upload");

  script_set_attribute(attribute:"synopsis", value:
"The remote Joomla! application has an extension installed that is affected by an arbitrary files upload vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the iCagenda extension for the Joomla! application running on the remote host is 3.2.1 prior to 3.9.15
or 4.x prior to 4.0.8. It is, therefore, affected by an arbitrary files upload vulnerability in the file attachment
feature, ultimately resulting in PHP code upload and execution.

Note that Nessus has not tested for this issue but has instead relied only on the extension's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.icagenda.com/docs/changelog/icagenda-3-9-15");
  script_set_attribute(attribute:"see_also", value:"https://www.icagenda.com/docs/changelog/icagenda-4-0-8");
  script_set_attribute(attribute:"see_also", value:"https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/");
  # https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d82629b9");
  script_set_attribute(attribute:"solution", value:
"Upgrade the iCagenda extension to version 3.9.15, 4.0.8 or later through the administrative dashboard.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-48939");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:joomla:joomla\!");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("joomla_extension_detect.nbin");
  script_require_keys("installed_sw/Joomla!", "www/PHP");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("vcf.inc");
include("vcf_extras.inc");

app_info = vcf::joomla::extension::get_app_info(extension:"icagenda");
vcf::check_granularity(app_info:app_info, sig_segments:3);

constraints = [
  { "min_version" : "3.2.1", "fixed_version" : "3.9.15", "fixed_display" : "3.9.15 / 4.0.8" },
  { "min_version" : "4.0", "fixed_version" : "4.0.8"}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);