Description

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution. The root cause is an improper access control check (CWE-284) on the profiles.import endpoint at index.php?option=com_jce&task=profiles.import.

Attack Chain

1. Fingerprint — Detect JCE version via jce.xml
2. Extract CSRF Token — Scrape from Joomla homepage
3. Import Malicious Profile — POST XML profile setting ordering:-99999, enabling PHP uploads, disabling MIME/extension validation
4. Upload Webshell — POST PHP payload via JCE browser RPC plugin
5. Execute — Access uploaded shell to trigger PHP execution

🚀 Features

• ✅ Safe Scan Mode — Fingerprinting + endpoint probe only (no exploitation)
• ✅ Exploit Mode — Full RCE chain: profile import → webshell upload
• ✅ Mass Scanner — Multi-threaded scanning from target list
• ✅ 5 PHP Payload Variants — Backtick, concat obfuscation, GIF header bypass
• ✅ Version Detection — Identifies JCE version and vulnerability status
• ✅ CSRF Token Extraction — Automatic extraction from Joomla pages
• ✅ Proxy Support — Compatible with Burp Suite, ZAP, mitmproxy
• ✅ Output Logging — Saves confirmed shells to file

📦 Requirements

• Python 3.7+
• requests library