CVE-2026-56290: Joomlack Page Builder Improper Access Control Exploitation

union CommonSecurityLog, W3CIISLog
| where TimeGenerated >= ago(7d)
| where RequestURL has_any ("/index.php?option=com_ckpagebuilder", "/index.php?option=com_pagebuilder", "/administrator/index.php?option=com_ckpagebuilder")
| where RequestURL has_any ("task=save", "task=edit", "task=delete", "task=publish", "view=page", "view=element")
| where isnotempty(RequestClientApplication)
| extend SuspiciousAccess = iff(
    RequestURL has "administrator" and not(SourceIP in ("known_admin_ips")),
    true, false
  )
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, SuspiciousAccess, RequestClientApplication, Computer
| order by TimeGenerated desc

index=web OR index=iis
| search uri_path IN ("*option=com_ckpagebuilder*", "*option=com_pagebuilder*")
| search uri_query IN ("*task=save*", "*task=edit*", "*task=delete*", "*task=publish*", "*task=apply*")
| eval is_admin_path=if(like(uri_path, "%administrator%"), 1, 0)
| eval suspicious=if(is_admin_path=1 AND NOT match(src_ip, "^10\.\.+|^192\.168\.\.+|^172\.(1[6-9]|2[0-9]|3[01])\."), 1, 0)
| stats count by src_ip, uri_path, uri_query, http_method, http_user_agent, suspicious
| where count > 1
| sort -count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   url.path : "*option=com_ckpagebuilder*" and
   url.query : "*task=*" and
   http.request.method in ("GET", "POST")]
  [network where event.category == "network" and
   url.path : "*option=com_ckpagebuilder*" and
   http.response.status_code == 200]

SELECT sourceip, destinationip, URL, username, eventcount, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx')
AND URL ILIKE '%option=com_ckpagebuilder%'
AND (URL ILIKE '%task=save%' OR URL ILIKE '%task=edit%' OR URL ILIKE '%task=delete%' OR URL ILIKE '%task=publish%' OR URL ILIKE '%task=apply%')
AND username IN ('', 'anonymous', '-')
LAST 7 DAYS
GROUP BY sourceip, destinationip, URL, username, starttime
HAVING eventcount > 2
ORDER BY starttime DESC

_sourceCategory=web/access OR _sourceCategory=iis/access
| parse "* * * [*] \"* * *\" * *" as src_ip, ident, auth, datetime, method, uri, protocol, status, bytes nodrop
| where uri matches "*option=com_ckpagebuilder*"
| where uri matches "*task=save*" OR uri matches "*task=edit*" OR uri matches "*task=delete*" OR uri matches "*task=publish*"
| timeslice 1h
| count by _timeslice, src_ip, uri, method, status
| where _count > 3
| sort by _timeslice desc

rule cve_2026_56290_joomlack_access_control {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects exploitation of CVE-2026-56290 Joomlack Page Builder improper access control"
    severity = "HIGH"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.request_url = /option=com_ckpagebuilder/
    $http.network.http.request_url = /task=(save|edit|delete|publish|apply)/
    $http.network.http.response_code = 200
    $ip = $http.principal.ip

  match:
    $ip over 10m

  condition:
    #http > 3
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| filter HttpUrl=/option=com_ckpagebuilder/ AND HttpUrl=/(task=save|task=edit|task=delete|task=publish)/
| groupby([LocalAddressIP4, HttpUrl, HttpMethod, HttpStatus], function=count(1, as=RequestCount))
| filter RequestCount > 2
| sort RequestCount desc
| limit 100