Jenderal92/CVE-2026-49049

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2.7 mass scanner that checks Joomla sites for CVE-2026-49049 by sending a crafted POST request to the Helix3 com_ajax endpoint and then verifying whether a PHP payload was executed or stored as raw text.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python 2 script that implements a mass scanner for CVE-2026-49049. The script sends crafted POST requests to a Joomla Helix3 endpoint to upload a PHP file and then checks whether the PHP code is executed. All behavior is consistent with the stated purpose of vulnerability scanning. No concealed operator-directed harm, credential theft, persistence, or unrelated payloads were observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareJoomlaHelix3 plugin
Attack typesImproper Access ControlRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is checking for vulnerability without exploiting it. It sends a request to trigger file upload and then inspects the response to determine if code execution occurred, classifying targets as vulnerable or not. It does not provide an interactive shell or perform post-exploitation actions; it only detects and reports exposure.

cve-2026-49049.py:46-132README.md:1-3

Requirements

  • Python 2.7 and requests libraryREADME.md:32-33
  • Target list file with one URL per lineREADME.md:54-55

Observed behavior

  • Sends POST request to /index.php?option=com_ajax&plugin=helix3&format=json with payload containing directory traversal path, PHP file name, and PHP contentcve-2026-49049.py:57-95
  • Checks if uploaded PHP file is accessible and whether PHP code was executed or displayed as raw textcve-2026-49049.py:100-118
  • Classifies target as VULNERABLE if PHP code executed, RAW PHP if uploaded but not executed, or NOT VULNERABLE otherwisecve-2026-49049.py:107-129
  • Saves results to results.txt (vulnerable) and rez.txt (raw PHP)cve-2026-49049.py:31-44
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Uploaded Payload
PHP code containing a simple web shell with file upload functionalityThe payload is uploaded to the target server as part of the vulnerability check. It is a standard proof-of-concept payload that echoes a string and provides an upload form, consistent with demonstrating remote code execution.cve-2026-49049.py:69-86
Network Request
POST to /index.php?option=com_ajax&plugin=helix3&format=jsonThe script targets the vulnerable endpoint described in CVE-2026-49049 to test for the vulnerability.cve-2026-49049.py:57cve-2026-49049.py:98
Output File
results.txt and rez.txtThe script writes results to local files, which is normal for a scanner.cve-2026-49049.py:17-18cve-2026-49049.py:37-44
Review boundaries

What the analysis did not establish

  • Evidence is limited to static source code analysis; no runtime behavior or network traffic was observed.
  • The artifact is described as a scanner in its own documentation and code comments, but classification is based on code logic, not self-labeling.
  • Only the two text files (README.md and cve-2026-49049.py) were reviewed; no binary files or network captures were provided.
  • The review does not assess the safety of the uploaded PHP payload on a target system, only whether the scanner itself contains backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1