Support

Hello,

looking at the repository, it seems just a framework to exploit a plugin that is vulnerable. This is just a tool to automate some steps to create a new user using some third party vulnerability, not to actually hack Joomla core.

So Admin Tools is already protecting you, since it's blocking requests to the vulnerable plugin.

Anyway, thank you for the heads up.

This is really nothing novel, nor much of a hacking tool. If the target's site has known cross site scripting (XSS) vulnerabilities you drop this script into the XSS vulnerable component and wait for a Super User to visit this page. In this case, the code will run(* BIG ASTERISK *) with Super User privileges, creating a new Super User account under the attacker's control.

First of all, this requires a not yet patched XSS vulnerability. If you keep your site and its extensions up to date, and use sane text filtering settings (the defaults are fine) you don't have any known XSS vulnerability.

The second part is the * BIG ASTERISK *. Will the exploit code run? This depends on your Content Security Policy (CSP) header. This is something you can tweak either with the System - HTTP Headers plugin in Joomla!, or by writing your own CSP into the .htaccess Maker's custom code section.

None of that is new, newsworthy, or even important.

XSS vulnerabilities have existed ever since JavaScript existed, 28 years ago. It's part of what we try to protect against with sane security practices, security tools, and updates.