{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "Joomla iCagenda public event submission form endpoint /index.php?option=com_icagenda&task=submit.submit, alternate jform[image] upload field",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "mysql:8.0",
    "joomla:6.0-php8.3-apache",
    "icagenda 4.0.7 vulnerable control",
    "icagenda 4.0.8 fixed target"
  ],
  "variant_observations": {
    "vulnerable_image_rce": false,
    "fixed_image_rce": false,
    "vulnerable_image_stored": true,
    "fixed_image_stored": true
  },
  "proof_artifacts": [
    "logs/vuln_variant/reproduction_steps.log",
    "logs/vuln_variant/vulnerable_source.log",
    "logs/vuln_variant/fixed_source.log",
    "logs/vuln_variant/vulnerable_version.txt",
    "logs/vuln_variant/fixed_version.txt",
    "vuln_variant/form_page_vulnerable.html",
    "vuln_variant/form_page_fixed.html",
    "vuln_variant/upload_image_vulnerable.log",
    "vuln_variant/upload_image_fixed.log",
    "vuln_variant/fetch_image_vulnerable_php.log",
    "vuln_variant/fetch_image_vulnerable_gif.log",
    "vuln_variant/fetch_image_fixed_php.log",
    "vuln_variant/fetch_image_fixed_gif.log",
    "vuln_variant/submitted_images_vulnerable.txt",
    "vuln_variant/submitted_images_fixed.txt"
  ],
  "notes": "No bypass confirmed: the alternate public image upload field was reached and stored image/gif content, but neither iCagenda 4.0.7 nor fixed 4.0.8 executed the uploaded payload as PHP in the tested Joomla Apache runtime."
}