Jenderal92/CVE-2026-56290

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2.7 mass exploitation tool for CVE-2026-56290 that uploads a PHP web shell to vulnerable Joomla Page Builder CK instances via an unauthenticated file upload vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python 2 exploit script (CVE-2026-56290.py) and a README.md file. The script targets CVE-2026-56290, an unauthenticated file upload vulnerability in the Joomla Page Builder CK extension. It extracts a CSRF token, uploads a PHP web shell to a known writable directory, and confirms successful upload. The uploaded shell provides a file upload form and displays system information. No backdoor, deceptive payload, or concealed operator-directed harm targeting the person running the PoC was observed. The script's behavior is consistent with a standard proof-of-concept exploit for the stated vulnerability.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareJoomla Page Builder CK
Attack typesRemote Code ExecutionUnrestricted File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as an exploit because its primary purpose is to exercise the CVE-2026-56290 vulnerability by uploading a functional PHP web shell to a target system, thereby achieving remote code execution. The code actively exploits the vulnerability rather than merely detecting it.

CVE-2026-56290.py:94-141CVE-2026-56290.py:103README.md:17

Requirements

  • A list of target Joomla URLs, one per line, provided as a command-line argument.CVE-2026-56290.py:181-189
  • Python 2.7 with requests and colorama libraries installed.README.md:42-50

Observed behavior

  • Fetches a CSRF token from the target Joomla site's homepage.CVE-2026-56290.py:62-92
  • Uploads a PHP web shell to the /media/com_pagebuilderck/gfonts/ directory via an unauthenticated POST request to index.php?option=com_pagebuilderck&task=browse.ajaxAddPicture.CVE-2026-56290.py:94-141
  • Confirms successful shell upload by sending a GET request to the uploaded file and checking for the string 'Shinday' in the response.CVE-2026-56290.py:128-133
  • Saves the URL of the confirmed web shell to a local file (reslt.txt) for later access.CVE-2026-56290.py:32-37
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Uploaded Web Shell
<?php $s="Shinday";echo'<center><pre><br><br><h1 style="color:red;">'.$s.'</h1><br>'.php_uname()."\\n".'<br><br><br><form method="post" enctype="multipart/form-data"><input type="file" name="__"><input name="_" type="submit" value="Upload"></form>';if($_POST){$t=$_FILES['__']['tmp_name'];$n=$_FILES['__']['name'];if(@move_uploaded_file($t,$n)){echo'<b style="color:green;">Upload success</b><br><br><a href="'.$n.'" target="_blank">Click here</a>';}elseif(@copy($t,$n)){echo'<b style="color:green;">Upload success(copy)</b><br><br><a href="'.$n.'" target="_blank">Click here</a>';}else{echo'<b style="color:red;">Upload failed</b>';}}?>The PHP code uploaded to the target server. It displays a banner, system information, and a file upload form. This is a standard web shell used to demonstrate remote code execution on the vulnerable target, not a payload targeting the exploit operator.CVE-2026-56290.py:103
Target Upload Path
media/com_pagebuilderck/gfonts/The directory on the target Joomla server where the PHP shell is uploaded. This path is specific to the vulnerable component and is used to achieve RCE on the target.CVE-2026-56290.py:100
Output File
reslt.txtThe local file where successful shell URLs are saved. This is standard output logging for a mass exploitation tool and does not indicate backdoor behavior.CVE-2026-56290.py:23
Review boundaries

What the analysis did not establish

  • The evidence includes only the Python exploit script and its README; no network traffic, execution logs, or target environment details are provided to confirm the exploit's effectiveness.
  • Review is limited to the supplied text files (CVE-2026-56290.py and README.md). No binary files were present. The script is not executed, and dynamic behavior is not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1