shinthink/CVE-2026-54390

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a mass scanner that detects JTL Shop instances vulnerable to CVE-2026-54390 by checking for JTL markers, version strings, and contact form presence. It optionally submits a blind SSTI probe via the contact form but does not verify execution or achieve RCE.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python-based PoC scanner and a README for CVE-2026-54390, a server-side template injection vulnerability in JTL Shop. The Python script performs detection, version fingerprinting, contact form discovery, and optional SSTI payload submission. All behavior is consistent with a legitimate security research tool: it sends HTTP requests to user-supplied targets, parses responses for JTL Shop markers, and submits crafted form data to demonstrate the vulnerability. No concealed executable behavior, persistence mechanisms, credential theft, unrelated remote access, or deceptive payloads were observed. The script does not execute any received payloads or establish backdoor access.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareJTL Shop
Attack typesServer-Side Template Injection (SSTI)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary operation is detection and reporting of vulnerable JTL Shop instances. The code identifies JTL Shop, checks version vulnerability, and locates contact forms. The optional --exploit flag only submits a blind SSTI probe and checks for form submission success; it does not extract data, establish a shell, or verify code execution. The README describes manual exploitation steps but the code itself does not implement them. This matches the definition of a scanner.

cve_2026_54390.py:269-309cve_2026_54390.py:349-354README.md:8-9README.md:99-154

Requirements

  • Target must be a JTL Shop instance running a vulnerable version (5.2.0–5.7.1) with an accessible contact form.cve_2026_54390.py:143-163cve_2026_54390.py:167-217

Observed behavior

  • Detects JTL Shop by searching homepage HTML for JTL markers and extracting version from static asset paths or specific file paths.cve_2026_54390.py:84-141
  • Checks if the detected version falls within the vulnerable range (5.2.0–5.7.1, excluding patched versions 5.5.4+, 5.6.2+, 5.7.2+).cve_2026_54390.py:143-163
  • Discovers contact forms by requesting known paths and parsing HTML for form action, CSRF token, and subject IDs.cve_2026_54390.py:167-217
  • Optionally submits a contact form with a blind SSTI payload ({7*7}) and checks for success markers in the response, but does not verify SSTI execution.cve_2026_54390.py:221-265cve_2026_54390.py:349-354
  • Outputs a list of vulnerable hosts and saves them to a file if specified.cve_2026_54390.py:362-366
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Activity
HTTP GET and POST requests to user-supplied targetsThe script sends HTTP requests to detect JTL Shop instances and optionally submits SSTI payloads via contact forms. This is expected behavior for a vulnerability scanner.cve_2026_54390.py:93cve_2026_54390.py:174cve_2026_54390.py:252-253
Payload Submission
Smarty SSTI payloads {7*7} and file_get_contents-based OOB callbacksThe script can submit template injection payloads to demonstrate the vulnerability. The payloads are standard SSTI test strings and do not contain hidden malicious code.cve_2026_54390.py:44-46cve_2026_54390.py:236-237
File Operation
Writes vulnerable target list to user-specified output fileThe script saves identified vulnerable hosts to a file for reporting purposes. This is a standard feature of security scanners.cve_2026_54390.py:364-366
Review boundaries

What the analysis did not establish

  • One file (unclassified, 70 bytes) was omitted from the evidence; its content is unknown but unlikely to change classification given the complete text of the main script and README.
  • The evidence does not include runtime behavior or confirmation that the scanner successfully identifies vulnerable instances.
  • One file (metadata only, not text) was omitted from the evidence packet; its content is unknown but flagged as non-text and not analyzed.
  • The review is limited to the supplied static source code; runtime behavior or external dependencies were not executed or analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1