CVE-2026-49049 Scanner & Auto-Write

A specialized security research tool for identifying and testing the CVE-2026-49049 vulnerability affecting the JoomShaper Helix3 framework.

Educational purposes only. This project is intended for authorized security testing and vulnerability research.

Overview

This tool automates the identification of Joomla instances that may be affected by CVE-2026-49049. It performs non-destructive checks to verify whether the vulnerable onAjaxHelix3 AJAX handler is exposed.

Features

• Multi-path write testing
• Session persistence using requests.Session()
• Automatic verification of write operations
• Batch target scanning
• Simple CLI interface
• Lightweight and easy to use

Credits & Attribution

This project is based on publicly disclosed security research.

Primary Research

• Phil Taylor (mySites.guru)
  • Original vulnerability discovery and technical analysis.

Reference Research

• shinthink
  • Public research repository and PoC structure used as a conceptual reference during development.

All credit for the vulnerability discovery belongs to the original researchers.

Usage

Install Requirements

pip install -r requirements.txt

Run

python3 helix3_scanner.py

Vulnerability Overview

The vulnerability exists within the onAjaxHelix3 handler due to insufficient security validation.

Supported actions include:

• save
• remove
• import (Helix3 v3.x only)

The scanner validates whether the target appears to expose the vulnerable functionality.

Project Structure

.
├── helix3.py
├── requirements.txt
├── README.md

Requirements

• Python 3.8+
• requests

Install dependencies:

pip install -r requirements.txt

Disclaimer

This project is provided for educational purposes and authorized security testing only.

The author is not responsible for any misuse, damage, or illegal activities resulting from the use of this software.

Always obtain explicit permission before testing any systems that you do not own or administer.

Acknowledgements

Special thanks to the original security researchers whose public disclosure and technical analysis made further security research possible.

• Phil Taylor (mySites.guru)
• shinthink

License

This repository is released for educational and research purposes only.

Please respect responsible disclosure practices and applicable laws within your jurisdiction.