shinthink/CVE-2026-56291

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based mass exploitation tool for CVE-2026-56291, an unauthenticated arbitrary file upload vulnerability in the Balbooa Forms Joomla extension. The script detects vulnerable targets, uploads a PHP web shell, executes a command to confirm remote code execution (RCE), and optionally cleans up the shell.

Backdoor review

No backdoor observed in reviewed code

The PoC exploit script (cve_2026_56291.py) performs only the advertised CVE-2026-56291 exploitation: detecting vulnerable Balbooa Forms instances, uploading a PHP webshell, verifying RCE, and optionally cleaning up. No concealed backdoor, credential theft, persistence, or unrelated payload behavior is present. The shell code is a simple system command executor used solely for verification.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareBalbooa Forms (com_baforms) for Joomla
Attack typesRemote Code ExecutionArbitrary File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively exploits CVE-2026-56291 by uploading a PHP web shell to a vulnerable target and executing commands on the remote server. The README describes it as a 'Mass RCE Exploit' and the code contains functions to deploy a shell, check for RCE, and execute commands.

README.md:8cve_2026_56291.py:107-156cve_2026_56291.py:158-162

Requirements

  • Target must be running a vulnerable version of the Balbooa Forms Joomla extension (versions 1.0 through 2.4.0).README.md:15
  • The target's web server must be configured to execute PHP files in the upload directory.cve_2026_56291.py:11

Observed behavior

  • Detects the presence of the Balbooa Forms component by sending HTTP GET requests to known component paths and checking for the string 'baforms' in the response.cve_2026_56291.py:88-105
  • Uploads a PHP web shell by sending a multipart POST request to the unauthenticated 'form.uploadAttachmentFile' task endpoint. The script attempts multiple form IDs, file extensions (.php, .phtml), and upload methods.cve_2026_56291.py:107-156
  • Verifies successful remote code execution by sending a GET request to the uploaded shell with the command 'id' and checking for 'uid=' in the response.cve_2026_56291.py:158-162
  • Optionally cleans up the uploaded shell by sending a GET request with a command to delete the file.cve_2026_56291.py:164-166
  • Supports mass scanning and exploitation of multiple targets from a file using multi-threading.cve_2026_56291.py:198-218
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
<?php echo "S|";system($_GET["c"]." 2>&1");echo "|E";The PHP payload uploaded to the target to achieve RCE, consistent with the described vulnerability.cve_2026_56291.py:110
Command Execution
id;hostname;uname -aCommand executed on the target to verify RCE after shell upload.cve_2026_56291.py:186
Cleanup Mechanism
self._delete_shell(sess, shell["url"])Optional cleanup deletes the uploaded shell using a self-deletion command, leaving no persistent backdoor.cve_2026_56291.py:189
Review boundaries

What the analysis did not establish

  • One file (metadata only) was omitted from the evidence packet, but the complete text of the main exploit script and README was provided.
  • One file (70 bytes, unclassified) was not analyzed as text; its metadata-only inventory entry provides no behavioral evidence.
  • The review does not assess the safety or legality of using this exploit against unauthorized targets.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1