iCagenda Joomla extension unauthenticated arbitrary file upload → RCE

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-48939 (iCagenda Joomla RCE)
# Usage: ./check_icagenda.sh <joomla_webroot>
# Exits 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
ROOT="${1:-/var/www/html}"
MANIFEST="$ROOT/administrator/components/com_icagenda/icagenda.xml"
ATTACH_DIR="$ROOT/images/icagenda/frontend/attachments"

if [ ! -f "$MANIFEST" ]; then
  echo "UNKNOWN: iCagenda manifest not found at $MANIFEST"
  exit 2
fi

VER=$(grep -oE '<version>[^<]+' "$MANIFEST" | head -n1 | sed 's/<version>//')
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse version"
  exit 2
fi
echo "Installed iCagenda version: $VER"

# semver-ish compare: patched if >=4.0.8, or >=3.9.15 on 3.x branch
vuln=1
IFS='.' read -r MAJ MIN PAT <<< "$VER"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}
if [ "$MAJ" -gt 4 ]; then vuln=0; fi
if [ "$MAJ" -eq 4 ] && { [ "$MIN" -gt 0 ] || [ "$PAT" -ge 8 ]; }; then vuln=0; fi
if [ "$MAJ" -eq 3 ] && [ "$MIN" -eq 9 ] && [ "$PAT" -ge 15 ]; then vuln=0; fi

# Even patched — hunt for planted shells
SHELLS=0
if [ -d "$ATTACH_DIR" ]; then
  SHELLS=$(find "$ATTACH_DIR" -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.php[3457]' \) 2>/dev/null | wc -l)
  if [ "$SHELLS" -gt 0 ]; then
    echo "WARNING: $SHELLS suspicious PHP-executable file(s) found in $ATTACH_DIR:"
    find "$ATTACH_DIR" -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' \) -printf '  %p (mtime %TY-%Tm-%Td)\n'
  fi
fi

if [ "$vuln" -eq 1 ]; then
  echo "VULNERABLE: iCagenda $VER is affected by CVE-2026-48939. Upgrade to 4.0.8 or 3.9.15."
  exit 1
fi
if [ "$SHELLS" -gt 0 ]; then
  echo "VULNERABLE: iCagenda patched but suspicious artifacts present — assume prior compromise."
  exit 1
fi
echo "PATCHED: iCagenda $VER is not affected and attachments dir is clean."
exit 0