CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted File Upload

union
  (
    AzureDiagnostics
    | where Category == "ApplicationGatewayAccessLog"
    | where requestUri_s matches regex @"(?i)/components/com_sppagebuilder/.*upload"
    | where httpStatus_d in (200, 201, 202)
    | extend FileName = extract(@"filename[^;\r\n]*;[\s]*filename[^;\r\n]*=[\s]*([^;\r\n]*)", 1, tostring(requestBody_s))
    | extend FileExt = extract(@"\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|rb|sh|bash)$", 0, tolower(FileName))
    | where isnotempty(FileExt)
    | extend AlertDetail = strcat("Dangerous file upload via SP Page Builder: ", FileName)
    | project TimeGenerated, requestUri_s, clientIP_s, FileName, FileExt, AlertDetail
  ),
  (
    W3CIISLog
    | where csUriStem matches regex @"(?i)/components/com_sppagebuilder"
    | where csMethod == "POST"
    | where scStatus in (200, 201)
    | extend SuspiciousExt = extract(@"(?i)\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|rb|sh|bash)", 0, csUriQuery)
    | where isnotempty(SuspiciousExt)
    | project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, SuspiciousExt
  ),
  (
    CommonSecurityLog
    | where DeviceVendor == "Imperva" or DeviceVendor == "F5"
    | where RequestURL matches regex @"(?i)/components/com_sppagebuilder.*upload"
    | where RequestMethod == "POST"
    | where AdditionalExtensions matches regex @"(?i)\.(php|phtml|phar|asp|aspx|jsp)"
    | project TimeGenerated, SourceIP, RequestURL, RequestMethod, AdditionalExtensions
  )
| extend CVE = "CVE-2026-48908"
| extend Tactic = "Initial Access / Execution"
| extend RiskScore = 90

index=web OR index=iis OR index=proxy
| eval uri=coalesce(uri_path, cs_uri_stem, request, url)
| eval method=coalesce(http_method, cs_method, method)
| eval status=coalesce(status, sc_status, http_response_code)
| eval src_ip=coalesce(src_ip, c_ip, clientip, src)
| where match(uri, "(?i)/components/com_sppagebuilder")
| where method="POST"
| where status IN ("200", "201", "202")
| eval body=coalesce(request_body, cs_uri_query, post_data, "")
| eval filename=if(match(body, "(?i)filename"), rex(body, "filename[^=]*=\s*[\"']?(?P<extracted_filename>[^\"\'\r\n;]+)"), "")
| eval file_ext=lower(rex(coalesce(filename, uri), "\.(?P<ext>php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|rb|sh|bash)$"))
| where isnotnull(file_ext) AND file_ext!=""
| eval cve="CVE-2026-48908"
| eval risk_score=90
| eval mitre_technique="T1190,T1505.003"
| stats count AS upload_attempts, values(file_ext) AS dangerous_extensions, values(uri) AS upload_uris, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, status, cve
| where upload_attempts >= 1
| sort -upload_attempts

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   http.request.method : "POST" and
   url.path : "*/components/com_sppagebuilder*" and
   http.response.status_code in (200, 201, 202)]
  [file where event.action in ("creation", "overwrite") and
   file.path : ("*/components/com_sppagebuilder/*", "*/uploads/*", "*/media/*") and
   file.extension : ("php", "php3", "php4", "php5", "php7", "phtml", "phar", "asp", "aspx", "jsp", "cgi", "pl", "py", "sh", "bash")]]
| filter sequence[0].http.request.body.content : "*filename*" or
         sequence[0].url.query : "*upload*"

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  "Method" AS http_method,
  "Response Code" AS http_status,
  EXTRACT(URL, 'filename=([^&;\r\n]+)') AS uploaded_filename,
  EXTRACT(URL, '\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|sh)$') AS dangerous_ext,
  'CVE-2026-48908' AS cve_id,
  90 AS risk_score
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx', 'F5 BIG-IP', 'Imperva SecureSphere')
  AND LOWER(URL) LIKE '%/components/com_sppagebuilder%'
  AND "Method" = 'POST'
  AND "Response Code" IN ('200', '201', '202')
  AND (
    LOWER(URL) MATCHES REGEX '.*\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|sh|bash).*'
    OR LOWER("Request Body") MATCHES REGEX '.*filename.*\.(php\d?|phtml|phar|asp|aspx|jsp).*'
  )
LAST 1 HOURS
ORDER BY event_time DESC

_sourceCategory=web/access OR _sourceCategory=iis OR _sourceCategory=proxy
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*POST.*(?P<uri>/[^\s]*/components/com_sppagebuilder[^\s]*).*(?P<status>2\d{2})"
| where status in ("200", "201", "202")
| parse regex field=uri "(?P<dangerous_ext>\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|sh|bash))" nodrop
| if (isEmpty(dangerous_ext), "none", dangerous_ext) as file_extension
| parse "*filename=*" as _x, filename nodrop
| parse regex field=filename "(?P<fname_ext>\.(php\d?|phtml|phar|asp|aspx|jsp))$" nodrop
| where !isEmpty(dangerous_ext) or !isEmpty(fname_ext)
| eval cve = "CVE-2026-48908"
| eval risk = 90
| count as upload_count by src_ip, uri, file_extension, fname_ext, status, cve, risk
| sort by upload_count desc

rule cve_2026_48908_sp_page_builder_upload {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects unrestricted file upload exploitation via JoomShaper SP Page Builder (CVE-2026-48908)"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_technique = "T1190"
    cve = "CVE-2026-48908"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48908"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "POST"
    re.regex($http.network.http.request_url, `(?i)/components/com_sppagebuilder`) nocase
    $http.network.http.response_code in (200, 201, 202)
    (
      re.regex($http.network.http.request_url, `(?i)\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|sh|bash)`) nocase
      or
      re.regex($http.network.http.user_agent, `(?i)(curl|python-requests|go-http|libwww)`) nocase
    )
    $http.principal.ip = $src_ip

  condition:
    $http
}

#event_simpleName IN ("HttpRequest", "NetworkConnectIP4", "WriteFile", "CreateFile")
| filter HttpMethod = "POST"
| filter match(TargetUrl, "(?i)/components/com_sppagebuilder")
| filter HttpStatusCode IN ("200", "201", "202")
| eval file_path = coalesce(FilePath, TargetFilename, "")
| eval dangerous_upload =
    if(match(TargetUrl, "(?i)\\.(php\\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|sh|bash)"), 1,
    if(match(file_path, "(?i)\\.(php\\d?|phtml|phar|asp|aspx|jsp)"), 1, 0))
| filter dangerous_upload = 1
| eval cve = "CVE-2026-48908"
| eval risk_score = 90
| eval mitre = "T1190,T1505.003"
| groupBy([SourceIP, TargetUrl, HttpStatusCode, file_path, cve, risk_score], function=[count(aid, as=event_count), min(timestamp, as=first_seen), max(timestamp, as=last_seen)])
| sort -event_count