THIS TOOL IS FOR AUTHORIZED SECURITY ASSESSMENTS ONLY.
Scanning systems you do NOT own or have WRITTEN PERMISSION to test is ILLEGAL in most jurisdictions.

The author (Hussein Mohamed masta ghimau) accepts ABSOLUTELY NO liability for any misuse, damage, legal action, or data loss arising from the use of this tool.

By running this scanner you agree to:

Only scan assets YOU OWN or have EXPLICIT WRITTEN CONSENT.

Understand that uploads a harmless POC PHP file to the target server as part of the intrusive accuracy check.

Manually delete every uploaded POC file immediately after use.

USE AT YOUR OWN RISK.

# 1. Clone the repo
git clone https://github.com/YOUR_USERNAME/masta-cve-2026-48907.git
cd masta-cve-2026-48907

# 2. (Optional but recommended) install extras
pip install -r requirements.txt

python masta-cve-2026-48907.py -u https://target.com

python masta-cve-2026-48907.py -u https://target.com/joomla

python masta-cve-2026-48907.py -l targets.txt -t 10

python masta-cve-2026-48907.py -u https://target.com -p http://127.0.0.1:8080

python masta-cve-2026-48907.py -h

  -u URL         Single target URL
  -l FILE        File containing URLs (one per line)
  -o OUTPUT      Custom Excel output path
  -t THREADS     Concurrent threads (default: 5)
  -p PROXY       Proxy URL (e.g. http://127.0.0.1:8080)
  --timeout N    Request timeout in seconds (default: 12)
  --verify-ssl   Enable SSL certificate verification (default: disabled)
  -v, --verbose  Show full per-target result cards during scan
  -d, --debug    Show internal HTTP request traces
  --no-color     Disable colored terminal output

flowchart TD
    A[User provides -u URL or -l FILE] --> B[Normalize & deduplicate targets]
    B --> C[Launch ThreadPoolExecutor]
    C --> D[For each target]

    D --> E1[probe_joomla<br/>GET /, meta, manifest,<br/>static assets, README]
    E1 --> F1{Joomla! detected?}
    F1 -- No --> R1[Status: NOT_JOOMLA]

    F1 -- Yes --> E2[probe_jce<br/>GET jce.xml, endpoints,<br/>JCE-specific markers]
    E2 --> F2{JCE detected?}
    F2 -- No --> R2[Status: SAFE<br/>JCE not installed]

    F2 -- Yes --> F3{Version >= 2.9.99.5?}
    F3 -- Yes --> R3[Status: PATCHED]

    F3 -- No --> E3[extract_csrf<br/>Parse Joomla! CSRF token]
    E3 --> F4{Token found?}
    F4 -- No --> R4[Status: PATCHED<br/>CSRF missing → likely hardened]

    F4 -- Yes --> E5[Build math-verifier payload<br/>masta-cve-2026-48907-poc ...]
    E5 --> E6[Vector 1: Multipart POST<br/>profile_file upload to tmp/]
    E6 --> F5{HTTP 200?}

    F5 -- Yes --> E7["GET /tmp/masta-{rand}.xml.php"]
    E7 --> F6{Body contains<br/>MATHOK:3105:END ?}
    F6 -- Yes --> R5[Status: VULNERABLE<br/>Confidence: CONFIRMED]
    F6 -- No --> E8[Vector 2: Browser chain<br/>upload + rename via RPC]
    E8 --> F7{RCE confirmed?}
    F7 -- Yes --> R5

    F7 -- No --> E9[Check for WAF block page]
    E9 --> F8{WAF detected?}
    F8 -- Yes --> R6[Status: BLOCKED_BY_WAF]
    F8 -- No --> R7[Status: SAFE]

    F5 -- No --> E8

    R1 --> S[Append result to Excel + Terminal card]
    R2 --> S
    R3 --> S
    R4 --> S
    R5 --> S
    R6 --> S
    R7 --> S

    S --> D
    D --> T[Print Summary Dashboard]
    T --> U[Save Excel Report to reports/]
    U --> V[Print cleanup reminder for<br/>all uploaded POC files]

    style R5 fill:#ff0000,stroke:#333,color:#fff
    style R3 fill:#32CD32,stroke:#333,color:#000
    style R6 fill:#FFD700,stroke:#333,color:#000

masta-cve-2026-48907-poc. This test is done as part of Security Assessment - masta ghimau.

🛡 Use it to protect your own assets. Not to harm others.