CVE-2026-48908

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2026-48908 by uploading a malicious ZIP file containing a PHP web shell and then executing arbitrary commands on the target server. It is not merely a scanner or writeup; it performs the exploitation steps to achieve remote code execution.

Requirements

• Target must run a vulnerable version of SP Page Builder (<= 6.6.1) with the uploadCustomIcon task accessible without authentication.sppb_rce.py:8-12
• The web server must allow PHP execution in the upload directory, or AllowOverride must be enabled for the .htaccess bypass method.README.md:45-49

Observed behavior

• Sends an unauthenticated POST request to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon with a crafted ZIP file containing a PHP web shell.sppb_rce.py:85-102
• Iterates through a list of PHP file extensions and a .htaccess bypass method, uploading a shell and checking for code execution by requesting the shell with a token and a test command.sppb_rce.py:115-140
• If code execution is confirmed, runs a user-specified command or provides an interactive pseudo-shell by sending HTTP requests to the uploaded web shell.sppb_rce.py:189-207

Observables

Token Guarded Webshell

Payload withheldThe uploaded PHP shell is guarded by a random per-run token, preventing unauthorized access.sppb_rce.py:65-66

Cleanup Function

Payload withheldThe script provides a --cleanup option to remove the payload directories it created.sppb_rce.py:209-216

Disclaimer

Payload withheldThe README and script header contain disclaimers stating the tool is for authorized testing only.README.md:160-177sppb_rce.py:28-29

Classification basis

The code actively exploits the vulnerability by uploading a malicious ZIP file containing a PHP webshell and then executing arbitrary commands on the target. It is not limited to detection or validation; it achieves remote code execution.

Requirements

• Target running Joomla with SP Page Builder component version <= 6.6.1README.md:13
• Network access to the target Joomla installationREADME.md:27

Observed behavior

• Crafts a ZIP archive containing a PHP webshell and supporting icon font filespoc_tot.go:146-204
• Uploads the crafted ZIP to the unauthenticated endpoint index.php?option=com_sppagebuilder&task=asset.uploadCustomIconpoc_tot.go:216-293
• Executes arbitrary system commands via HTTP GET requests to the extracted PHP webshellpoc_tot.go:304-336
• Provides an interactive pseudo-shell for continuous command executionpoc_tot.go:467-503

Observables

Exploit Behavior

Payload withheldThis is the core exploit functionality described in the README and CVE context. It is not a backdoor against the PoC user.poc_tot.go:146-150poc_tot.go:304-336

Network Connection

Payload withheldThe exploit upload endpoint. Connections are made only to the user-supplied target.poc_tot.go:234-235

File Write

Payload withheldThis is the intended exploit payload delivery mechanism.poc_tot.go:146-204

Classification basis

The script actively uploads a PHP webshell and executes commands on the target, which constitutes exploitation, not just detection or scanning.

Requirements

• Target running a vulnerable version of SP Page Builder (<= 6.6.1) with the com_sppagebuilder component accessible.CVE-2026-48908.py:5CVE-2026-48908.py:12

Observed behavior

• Constructs a malicious ZIP archive containing a PHP webshell and supporting IcoMoon files.CVE-2026-48908.py:61-98
• Sends an unauthenticated POST request to the vulnerable upload endpoint to upload the malicious ZIP.CVE-2026-48908.py:101-116
• Executes arbitrary system commands on the target server by sending GET requests to the uploaded webshell.CVE-2026-48908.py:119-125
• Provides an interactive shell mode for continuous command execution.CVE-2026-48908.py:187-198

Observables

Webshell Upload

Payload withheldThe PoC uploads a PHP file that executes system commands when provided with a correct token. This is the intended exploit behavior for the stated CVE.CVE-2026-48908.py:61-98

Command Execution

Payload withheldThe uploaded webshell executes arbitrary system commands passed via HTTP GET parameters. This is the core RCE functionality of the exploit.CVE-2026-48908.py:68-72

Token Verification

Payload withheldThe webshell requires a secret token to execute commands, preventing unauthorized use of the uploaded shell by third parties.CVE-2026-48908.py:64-67

Classification basis

The script actively uploads a PHP webshell and executes attacker-supplied commands on the target, which is the definition of an exploit. It does not merely detect the vulnerability; it exercises it to achieve remote code execution.

Requirements

• Target running SP Page Builder ≤ 6.6.1 with the vulnerable asset.uploadCustomIcon task exposed.README.md:3exploit_poc.py:18
• Python 3.8+ with requests and payload withheld libraries installed.README.md:25requirements.txt:1-2

Observed behavior

• Sends an unauthenticated POST request to the asset.uploadCustomIcon task with a ZIP file containing a PHP webshell.exploit_poc.py:59-83
• Extracts the uploaded webshell path from the JSON response and executes an arbitrary system command via HTTP GET request.exploit_poc.py:86-88exploit_poc.py:120-123
• Supports mass scanning of multiple hosts with multi-threading and saves results to categorized output files.exploit_poc.py:272-381

Observables

Built-In Webshell

Payload withheldThe default payload is a token-guarded PHP webshell that executes commands passed via the 'c' parameter. This is the expected exploit payload for the CVE.exploit_poc.py:39-40

Custom Shell Upload

Payload withheldThe script supports uploading an arbitrary PHP file as a custom webshell. This is a documented feature for authorized testing and does not introduce hidden behavior.exploit_poc.py:210-223

External Dependency

Payload withheldThe script imports 'payload withheld' (line 9), which is not a standard library and is listed in requirements.txt. Its purpose is unclear from the provided text, but it is used only for console output functions (info, success, warning, error) and does not introduce backdoor behavior.exploit_poc.py:9requirements.txt:2

Classification basis

The artifact is a fully functional Python script that actively exploits the vulnerability by uploading a malicious ZIP file containing a PHP web shell to the target server and then executing commands on it. This goes beyond detection or scanning; it performs the exploitation steps to achieve remote code execution.

Requirements

• Target must be running a vulnerable version of SP Page Builder (1.0.0 – 6.6.1) for Joomla.README.md:12
• The target's web server must allow PHP execution in the /media/ directory for full RCE, or at least allow file writes for partial impact.README.md:68-70

Observed behavior

• Sends an unauthenticated POST request to the vulnerable endpoint (index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon) with a crafted ZIP file containing a PHP web shell.sppb_rce.py:85-102
• The ZIP file is constructed to mimic a valpayload withheld icon-font package (selection.json, style.css, fonts/*.ttf) to pass the upload valpayload withheldation, while also containing a token-guarded PHP shell.sppb_rce.py:63-82
• Attempts multiple file extension and .htaccess bypass techniques to achieve code execution, stopping at the first successful method.sppb_rce.py:115-140
• Executes arbitrary system commands on the target server via the uploaded web shell and returns the output.sppb_rce.py:105-107sppb_rce.py:200-207

Observables

Token Guarded Webshell

Payload withheldThe dropped webshell is guarded by a random per-run token, preventing unauthorized access. This is a safety feature, not a backdoor.sppb_rce.py:65-66

Cleanup Functionality

Payload withheldThe script includes a cleanup option to remove the artifacts it creates, which is consistent with authorized testing and not indicative of a backdoor.sppb_rce.py:209-216

Default Command

Payload withheldThe default command executed is benign (payload withheld), and the script only runs commands supplied by the operator.sppb_rce.py:148

Classification basis

The primary artifact is a Python script that actively uploads a PHP web shell to a vulnerable target and verifies its execution, which is the definition of an exploit. The README explicitly describes it as a 'Proof-of-concept exploit'.

Requirements

• Target must be running a vulnerable version of SP Page Builder (1.0.0 - 6.6.1) with the uploadCustomIcon task exposed.README.md:16
• Python 2.7 and the 'requests' library are required to run the script.README.md:70-71

Observed behavior

• Constructs a ZIP archive mimicking a valid icon-font package containing a PHP web shell at 'fonts/shxt.php' or 'fonts/shxt.PHP'.CVE-2026-48908.py:26-50
• Sends a multipart POST request to the vulnerable 'asset.uploadCustomIcon' endpoint to upload the crafted ZIP file without authentication.CVE-2026-48908.py:52-59
• Verifies successful exploitation by sending a GET request to the uploaded shell and checking for the presence of the string 'Shinday' in the response.CVE-2026-48908.py:61-68
• Logs the URL of the successfully uploaded web shell to 'result.txt'.CVE-2026-48908.py:130-131

Observables

Webshell Payload

Payload withheldThe active PHP webshell embedded in the uploaded ZIP. It displays server information and provides a file upload form, which is standard for a PoC demonstrating RCE.CVE-2026-48908.py:29

Commented Out Payload

Payload withheldA commented-out PHP payload that would fetch and execute remote code. It is never assigned to shell_bytes or written to the ZIP; it remains inert.CVE-2026-48908.py:31

Classification basis

The script actively uploads a PHP webshell to a target server and verifies its execution, which constitutes exploitation rather than mere detection or scanning.

Requirements

• Target URL running vulnerable SP Page Builder extension (versions 1.0.0-6.6.1)poc.py:110-114
• List of target URLs provided as input filepoc.py:139-140

Observed behavior

• Constructs a ZIP archive containing a PHP webshell disguised as an icon font uploadpoc.py:31-49
• Sends POST request to the vulnerable upload endpoint without authenticationpoc.py:51-58
• Checks if the uploaded PHP shell is accessible and executable by verifying HTTP 200 response containing the marker 'Shinday'poc.py:60-67
• Writes successfully exploited shell URLs to result.txtpoc.py:128-131

Observables

Webshell

Payload withheldThe PHP payload embedded in the ZIP provides a file upload form on the compromised server. This is the intended exploit outcome for the CVE.poc.py:32

Exploit Mechanism

Payload withheldThe script uploads a crafted ZIP containing a PHP file to the vulnerable endpoint, consistent with the described arbitrary file upload vulnerability.poc.py:51-58poc.py:110-115

Classification basis

The artifact is a README.md file containing a vulnerability analysis, diagrams, and mitigation advice. It does not include any executable code, proof-of-concept script, or scanner logic. The content is purely descriptive and educational, fitting the definition of a writeup.

Requirements

• Target must be running a vulnerable version of JoomShaper SP Page Builder (1.0.0-6.6.1).README.md:21

Observed behavior

• Describes an unauthenticated POST request to an upload controller that writes a malicious file to a public web directory, followed by a GET request to execute the uploaded code.README.md:69-75
• Explains that the upload endpoint lacks authorization checks and relies on permissive extension validation.README.md:83-85

Observables

Vulnerability Report

Payload withheldThe artifact is a documentation-only repository describing an unauthenticated file upload vulnerability in JoomShaper SP Page Builder.README.md:1-129

Classification basis

The scanner.py file contains a complete Exploiter class that actively uploads a PHP payload and executes commands on the target, which is the definition of an exploit. The README.md describes the tool as a 'Scanner + PoC (Safe Exploit)' and provides instructions for using the --exploit flag to achieve RCE.

Requirements

• Target must be running a vulnerable version of SP Page Builder (<=6.6.1) with the uploadCustomIcon endpoint accessible without authentication.scanner.py:37scanner.py:44

Observed behavior

• The tool fingerprints the target to detect Joomla and SP Page Builder, then validates the vulnerable endpoint. If the --exploit flag is set and the target is classified as CONFIRMED, it attempts to upload a ZIP file containing a PHP webshell via the asset.uploadCustomIcon endpoint. It then accesses the uploaded shell to execute a test command (echo SPPB-RCE-$((7*6))) and confirms RCE if the output contains 'SPPB-RCE-42'.scanner.py:319-428scanner.py:455-473
• The exploit attempts multiple PHP file extensions and a .htaccess trick to bypass upload filters.scanner.py:383-390
• The uploaded PHP shell is token-protected and executes arbitrary system commands passed via the 'c' GET parameter.scanner.py:325-326

Observables

Webshell Upload

Payload withheldThe exploit uploads a PHP file that executes arbitrary commands, but this is the expected PoC behavior for demonstrating RCE. The shell is token-protected and only runs commands passed via the 'c' parameter.scanner.py:325-326

Command Execution

Payload withheldThe exploit verifies RCE by executing a harmless arithmetic command. This is a standard PoC technique and does not indicate malicious intent.scanner.py:408

Cleanup Instructions

Payload withheldThe tool provides manual cleanup instructions rather than automatically deleting files, which is a responsible disclosure practice.scanner.py:430-439