murrez/cve-2026-97163Python PoC for CVE-2026-97163: fingerprints Joomla UP plugin versions and probes com_ajax install triggers for unauthenticated remote action deployment.
Python 3 PoC for CVE-2026-97163 — UP (Universal Plugin) for Joomla (lomart.fr).
CVE-2026-97163 — UP 5.0.0–5.2.0 and 6.0.0–6.0.29 (especially the mini package without bundled actions) allow unauthenticated remote code installation: an anonymous request can start an on-demand download of action code from the maintainer’s GitHub repository into plugins/content/up/actions/, where Joomla executes it. The fetch ran with TLS certificate verification disabled, so a network-positioned attacker (MITM) could substitute a malicious archive (CWE-22, CWE-284). CVSS 4.0 10.0 Critical (PR:N). Fix: UP 6.1.0 / 5.2.1 (auth restrictions + TLS verify restored).
Research: mySites.guru — UP 6.1.0 security fixes
Related (same release): CVE-2026-97160 (PHP shortcode), CVE-2026-97161 (file read), CVE-2026-97162 (SQLi).
PoC page: https://pocbit.org/pocs/cve-2026-97163
Catalog: https://pocbit.org/pocs/
| Product | UP plugin (plg_content_up) |
| Affected | 5.0.0–5.2.0, 6.0.0–6.0.29 |
| Fixed | 5.2.1, 6.1.0 |
| Vector | Mini mode: first use of an action → GitHub zip → unpack under plugin |
| Impact | Integrity / RCE (with MITM or compromised fetch path) |
This PoC fingerprints UP, checks vulnerable versions, and probes com_ajax patterns (or --ajax-url / --render-url from your lab). It does not perform MITM or host malicious archives.
pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --install-probe
python poc.py -u https://joomla.example --mode exploit --install-probe --action slideshow-billboard
python poc.py -u https://joomla.example --mode exploit --render-url "https://joomla.example/index.php?option=com_content&view=article&id=99"
python poc.py -u https://joomla.example --mode exploit --ajax-url "https://joomla.example/index.php?option=com_ajax&group=content&plugin=up&..."
python poc.py --list targets.example.txt --mode check --install-probe -j 8
Post-patch: inspect plugins/content/up/actions/ for unknown PHP folders (vendor guidance).
body="plugins/content/up"
body="plg_content_up" "up.lomart"
CVE-2026-97163 PoC: Joomla UP (lomart.fr) unauth GitHub mini-install / remote action deployment (≤6.0.29). Version detect + com_ajax install probes. PoCbit
CVE-2026-97163: UP mini paketinde oturumsuz GitHub’tan action indirme tetiklenebiliyor; TLS doğrulama kapalı olduğu için MITM ile kötü arşiv enjekte edilebilir. 6.1.0 / 5.2.1 yamalar.
Authorized testing only.