Privilege escalation in Joomla! - CVE-2016-8869
Published: October 26, 2016 / Updated: September 14, 2018
Vulnerability identifier: #VU1076
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8869
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote user to bypass security restrictions and gain elevated privileges on the application.
The weakness is due to unknown error and lets a remote attacker register on the website as a member of group with elevated privileges.
Successful exploitation of the vulnerability results in privilege escalation.
The weakness is due to unknown error and lets a remote attacker register on the website as a member of group with elevated privileges.
Successful exploitation of the vulnerability results in privilege escalation.
Affected software
Joomla!
How to mitigate CVE-2016-8869
Update to version 3.6.4.
Links to Public Exploits and PoC-codes
- Exploit #1886 - Joomla-3.4.4-3.6.4_CVE-2016-8869_and_CVE-2016-8870 (Source code: https://github.com/XiphosResearch/exploits/tree/master/Joomraa) (March 18, 2020)
- Exploit #1889 - JoomlaCVE20168869 (Exploit for Joomla 3.4.4 - 3.6.4 (CVE-2016-8869 and CVE-2016-8870)) (March 18, 2020)
- Exploit #12 - Joomla Account Creation and Privilege Escalation (March 18, 2020)
- Exploit #443 - Joomla! 3.4.4 < 3.6.4 - Account Creation / Privilege Escalation (March 18, 2020)