shinthink/CVE-2026-61424

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-61424 that uploads a polyglot GIF webshell to vulnerable Joomla DJ-Classifieds instances via an unauthenticated file upload endpoint, then verifies remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-61424. It uploads a PHP webshell using a known filter bypass and verifies RCE. No concealed backdoor, credential theft, persistence, or unrelated payload was observed. The code performs only the advertised exploit behavior.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareDJ-ClassifiedsJoomla
Attack typesRemote Code ExecutionArbitrary File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively uploads a malicious webshell to a target and executes arbitrary commands, which constitutes exploitation rather than mere detection or scanning.

cve_2026_61424.py:385-419cve_2026_61424.py:232-320cve_2026_61424.py:326-363

Requirements

  • Target must run a vulnerable version of DJ-Classifieds (<= 3.11.1) with the imageupload task exposed.cve_2026_61424.py:3-4

Observed behavior

  • Detects DJ-Classifieds by requesting known XML manifest paths and parsing the version tag.cve_2026_61424.py:204-226
  • Generates a PHP webshell payload using only short open tags (<?=) to bypass a 3-string blocklist filter.cve_2026_61424.py:72-83
  • Embeds the webshell inside a valid GIF header to create a polyglot file that passes image validation.cve_2026_61424.py:86-108
  • Uploads the polyglot shell via an unauthenticated POST to the imageupload task endpoint.cve_2026_61424.py:232-320
  • Verifies remote code execution by sending commands (id;hostname;uname -a) to the uploaded shell and checking for expected output markers.cve_2026_61424.py:326-363
  • Supports mass exploitation mode with multi-threading, progress display, and optional output of successful RCE URLs.cve_2026_61424.py:426-513
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Uploads a PHP webshell via the imageupload endpoint and executes commands via ?c= parameterThis is the advertised exploit for CVE-2026-61424. The webshell uses PHP short tags to bypass a 3-string filter.cve_2026_61424.py:72-83cve_2026_61424.py:232-320cve_2026_61424.py:326-363
Cleanup Mechanism
The exploit attempts to delete the uploaded shell by defaultThe cleanup() method sends a command to the shell to remove itself, which is consistent with a responsible PoC and not a backdoor.cve_2026_61424.py:369-379
Review boundaries

What the analysis did not establish

  • Two files (unclassified_bytes: 1135, unclassified_file_count: 2) were not provided as text and could not be analyzed.
  • complete_artifact_coverage is false; only 3 of 5 files were included as readable text.
  • The analysis is based solely on static review of the provided source code; the exploit was not executed or tested.
  • Two files (metadata only) were omitted from the evidence packet and were not reviewed.
  • The review is limited to the supplied text; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1