shinthink/CVE-2026-65883

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-65883 that achieves unauthenticated RCE on Joomla sites running Aimy Captcha-Less Form Guard 18.0-20.0. It recovers a XOR keystream from a captcha form, builds a PHP object injection gadget (FormattedtextLogger), encrypts it, and sends it via the clfgd POST field to write a webshell, then verifies command execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2026-65883. The script performs the documented exploit: recovering a keystream, building a PHP object injection payload, and deploying a webshell for RCE verification. No concealed backdoor, unrelated payload, or operator-directed harm was observed. The script's behavior aligns with the stated CVE exploitation.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareAimy Captcha-Less Form GuardJoomla
Attack typesremote code executionobject injectiondeserialization of untrusted data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively exploits the vulnerability by recovering a keystream, building a PHP object injection payload, deploying a webshell, and executing commands on the target. It is not limited to detection or validation; it performs the full attack chain to achieve RCE.

cve_2026_65883.py:272-343cve_2026_65883.py:349-361

Requirements

  • Target must run Aimy Captcha-Less Form Guard 18.0-20.0 on Joomla with a captcha-protected form accessible.cve_2026_65883.py:255-266
  • Attacker must be able to send HTTP requests to the target and receive responses containing the clfgd hidden field and form HTML.cve_2026_65883.py:279-286

Observed behavior

  • Sends GET request to Joomla form paths to detect Aimy plugin by searching for 'clfgd' in response.cve_2026_65883.py:255-266
  • Extracts base64-encoded clfgd ciphertext and plaintext trap_ids from HTML to recover XOR keystream.cve_2026_65883.py:110-157
  • Constructs a PHP serialized object chain (FormattedtextLogger gadget) that writes a PHP webshell to the webroot.cve_2026_65883.py:70-103
  • Encrypts the gadget with the recovered keystream and sends it as the clfgd POST parameter to trigger unserialize() and deploy the webshell.cve_2026_65883.py:296-331
  • Verifies RCE by requesting the deployed webshell with a command parameter and checking for command output.cve_2026_65883.py:349-361
  • Supports mass scanning mode that exploits multiple targets concurrently and reports RCE URLs.cve_2026_65883.py:401-483
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Deployment
The script writes a PHP webshell containing 'system($_REQUEST["c"])' to the target webroot.This is the intended exploit payload for CVE-2026-65883, not a backdoor against the user running the PoC.cve_2026_65883.py:76-79
Rce Verification
The script verifies RCE by requesting the deployed shell with '?c=id;hostname;uname -a'.This is standard exploit verification, not a backdoor.cve_2026_65883.py:349-361
Review boundaries

What the analysis did not establish

  • Evidence includes only 3 of 5 repository files; 2 files (1129 bytes) are unclassified and omitted, but the primary exploit script and README are complete.
  • The artifact is not executed; classification is based solely on static analysis of the provided source code.
  • Two files (metadata only) were omitted from the evidence: their content was not reviewed.
  • The review covers only the supplied text; no binary or non-text content was analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1