CVE-2026-48909
published 2026-06-20CVE-2026-48909: SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute…
PriorityP276critical9.5CVSS 4.0
AVNACLATPPRNUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EXPLOIT
EPSS
4.94%
91.6th percentile
SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| joomshaper.net | sp_lms_extension_for_joomla | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for HTTP requests to /index.php?option=com_splms&view=cart carrying a cookie named 'lmsOrders' with a base64-encoded value; the payload is a PHP-serialized object targeting Joomla\CMS\Log\Logger\FormattedtextLogger. ↗
- →Alert on deserialization of a PHP object of class 'Joomla\CMS\Log\Logger\FormattedtextLogger' (length 43) arriving via the lmsOrders cookie; the serialized string will contain the class name literal. ↗
- →Detect file-write gadget chain execution: FormattedtextLogger.__destruct() calls File::write($path, $format), which drops a webshell to a PHP-writable path such as /tmp/x.php or /images/x.php. ↗
- →The exploit encodes the PHP payload via hex2bin() to bypass Joomla's 'cmd' input filter (which strips '/', '=', '+'); look for lmsOrders cookie values that are long base64 strings free of '/', '=', and '+' characters. ↗
- →RCE via this gadget chain is only possible on Joomla < 5.2.2; on patched Joomla (>= 5.2.2) FormattedtextLogger.__wakeup() blocks the chain, but PHP Object Injection in com_splms still exists. ↗
- →After the deserialization trigger, watch for a follow-up GET request to the written webshell path with query parameter '?c=id' or '?c=COMMAND', indicating shell verification by the attacker. ↗
- ·The exploit targets SP LMS (com_splms) versions strictly below 4.1.4; the vulnerable deserialization sink is at line 28 of com_splms/models/cart.php. ↗
- ·Full RCE via the FormattedtextLogger gadget chain requires Joomla < 5.2.2; on Joomla >= 5.2.2 __wakeup() blocks the chain and only PHP Object Injection (without a public RCE gadget) remains. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
joomshaper.net SP LMS Extension 1.0.0-4.1.3 deserialization (EUVD-2026-38108)
vuldb·2026-06-20·CVSS 9.5
CVE-2026-48909 [CRITICAL] joomshaper.net SP LMS Extension 1.0.0-4.1.3 deserialization (EUVD-2026-38108)
A vulnerability classified as critical has been found in joomshaper.net SP LMS Extension 1.0.0-4.1.3. This affects an unknown part. The manipulation leads to deserialization.
This vulnerability is traded as CVE-2026-48909. It is possible to initiate the attack remotely. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
ghsa_unreviewed·2026-06-20
CVE-2026-48909 [CRITICAL] CWE-502 SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
No detection rules found.
Exploit-DB
Joomla Extension 4.1.4 - PHP Object injection
exploitdb·2026-07-06·CVSS 9.5
CVE-2026-48909 [CRITICAL] Joomla Extension 4.1.4 - PHP Object injection
Joomla Extension 4.1.4 - PHP Object injection
---
Exploit Ttile: Joomla Extension 4.1.4 - PHP Object injection
Affected : JoomShaper SP LMS = 4.1.4
Author : Amin İsayev / Proxima Cyber Security
Joomla version note:
RCE requires Joomla = 5.2.2 patched FormattedtextLogger.__wakeup() which blocks the
gadget chain — PHP Object Injection still exists in com_splms but no
known public gadget chain leads to RCE on patched Joomla versions.
Attack chain:
lmsOrders cookie
→ unserialize(base64_decode($cookie)) [com_splms/models/cart.php:28]
→ FormattedtextLogger.__destruct() [Joomla gadget]
→ File::write($path, $format)
→ webshell on disk
Joomla Input filter note:
$cookie->get() uses 'cmd' filter by default → strips '/', '=', '+' from cookie.
Fix: pad format string so serialized total is divisibl
Nuclei
Joomla SP LMS <= 4.1.3 - Remote Code Execution
nuclei·CVSS 9.5
CVE-2026-48909 [CRITICAL] Joomla SP LMS <= 4.1.3 - Remote Code Execution
Joomla SP LMS > 2);
r += B64.charAt(((a & 3) > 4));
r += (i+1 > 6)) : "=";
r += (i+2 0 ? php + pad(" ", p) : php;
var e = b64(build(path, fmt));
if (e.indexOf("/") === -1 && e.indexOf("+") === -1) return e;
}
var chars = "abcdefghijklmnopqrstuvwxyz";
for (var p = 1; p ") === php.length - 2) {
fmt = php.substring(0, php.length - 2) + " /*" + pad(c, p) + "*/ ?>";
} else {
fmt = php + pad(c, p);
}
var e = b64(build(path, fmt));
if (e.indexOf("/") === -1 && e.indexOf("+") === -1) return e;
}
}
return "";
}
var wp = safe(filepath, "");
var cp = safe(filepath, "");
set("write_payload", wp);
set("cleanup_payload", cp);
set("marker", marker);
set("urlpath", "/images/" + filename);
http(1) && http(2) && http(3) && http(4) && http(5);
http:
- raw:
- |
GET /index.php?option=com_splms&view=cart HT
No writeups or analysis indexed.
2026-06-20
Published