Remote PHP code execution in Joomla! - CVE-2015-8562
Published: July 18, 2016 / Updated: May 3, 2021
Vulnerability identifier: #VU157
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-8562
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.
The vulnerability exists due to insufficient filtration of HTTP User-Agent header and filter-search HTTP POST parameter before storing them into database. A remote unauthenticated attacker can permanently inject and execute arbitrary PHP code on the target system with privileges of the web server.
Successful exploitation of this vulnerability will allow a remote attacker to gain complete control over the vulnerable web application and execute arbitrary PHP code on the target system.
Note: this is a zero-day vulnerability and it is being exploited in the wild.
Affected software
Joomla!
How to mitigate CVE-2015-8562
Update your Joomla! installation to version 3.4.6.
Links to Public Exploits and PoC-codes
- Exploit #5331 - setup-cve-2015-8562 (Docker-compose to set up a test environment for exploiting CVE-2015-8562) (May 3, 2021)
- Exploit #2609 - JoomlaMassExploiter ([discontinued] Mass exploiter of CVE 2015-8562 for Joomla! CMS) (April 27, 2020)
- Exploit #2270 - cve-2015-8562-exploit (CVE-2015-8562 Exploit in bash) (April 7, 2020)
- Exploit #1870 - joomla_rce_CVE-2015-8562 (All versions of the Joomla! below 3.4.6 are known to be vulnerable. But exploitation is possible with PHP versions below 5.5.29, 5.6.13 and below 5.5.) (March 18, 2020)
- Exploit #1874 - scanner-exploit-joomla-CVE-2015-8562 () (March 18, 2020)
- Exploit #99 - Joomla_CVE-2015-8562 (A proof of concept for Joomla's CVE-2015-8562 vulnerability (Object Injection RCE)) (March 18, 2020)
- Exploit #100 - JoomlaMassExploiter ([discontinued] Mass exploiter of CVE 2015-8562 for Joomla! CMS) (March 18, 2020)
- Exploit #366 - Joomla! 1.5 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution (March 18, 2020)
- Exploit #367 - Joomla! 1.5 < 3.4.5 - Object Injection Remote Command Execution (March 18, 2020)
- Exploit #1773 - Joomla HTTP Header Unauthenticated Remote Code Execution (March 18, 2020)