CVE-2016-8869

This exploit leverages a file upload vulnerability in Joomla's com_users component, bypassing whitelisting by using .pht extensions and <?= tags to achieve remote code execution. It automates user creation, admin login, and payload upload.

This is a functional exploit for Joomla 3.4.4 to 3.6.4 that chains authentication bypass (CVE-2016-8869) with file upload restrictions bypass (CVE-2016-8870) to achieve remote code execution via a .pht web shell upload.

This repository provides a Dockerized vulnerable Joomla 3.5 environment configured to exploit CVE-2016-8869, a SQL injection vulnerability. The Dockerfile modifies the Joomla database to enable the vulnerable state, allowing for testing of the exploit.

This Python script exploits CVE-2016-8869 and CVE-2016-8870 in Joomla versions 3.4.4 to 3.6.4 by creating an administrator account via a CSRF token bypass and then leveraging misconfigured file upload settings to achieve remote code execution.

This Metasploit module exploits CVE-2016-8869 and CVE-2016-8870 to create an arbitrary Joomla user account with administrative privileges by leveraging a CSRF token bypass and improper access control in Joomla versions 3.4.4 through 3.6.3.