Joomla! <3.6.4 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2016-8869 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 5 public exploits from researchers including Xiphos Research Ltd, rustyJ4ck, cved-sources, including a Metasploit module auxiliary/admin/http/joomla_registration_privesc.
AI-analyzed exploit summary This exploit leverages a file upload vulnerability in Joomla's com_users component, bypassing whitelisting by using .pht extensions and <?= tags to achieve remote code execution. It automates user creation, admin login, and payload upload.
Description
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.
Exploits (5)
This exploit leverages a file upload vulnerability in Joomla's com_users component, bypassing whitelisting by using .pht extensions and <?= tags to achieve remote code execution. It automates user creation, admin login, and payload upload.
This is a functional exploit for Joomla 3.4.4 to 3.6.4 that chains authentication bypass (CVE-2016-8869) with file upload restrictions bypass (CVE-2016-8870) to achieve remote code execution via a .pht web shell upload.
This repository provides a Dockerized vulnerable Joomla 3.5 environment configured to exploit CVE-2016-8869, a SQL injection vulnerability. The Dockerfile modifies the Joomla database to enable the vulnerable state, allowing for testing of the exploit.
This Python script exploits CVE-2016-8869 and CVE-2016-8870 in Joomla versions 3.4.4 to 3.6.4 by creating an administrator account via a CSRF token bypass and then leveraging misconfigured file upload settings to achieve remote code execution.
This Metasploit module exploits CVE-2016-8869 and CVE-2016-8870 to create an arbitrary Joomla user account with administrative privileges by leveraging a CSRF token bypass and improper access control in Joomla versions 3.4.4 through 3.6.3.
References (8)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H