Joomla! < 3.6.4 - Improper Access Control via Registration Form Session Data
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2016-9838. PoCs published by Charles Fol, cved-sources.
AI-analyzed exploit summary This exploit leverages a vulnerability in Joomla! <= 3.6.4 to take over an admin account by manipulating the registration form to associate a new user with an existing admin ID. It bypasses password validation by first submitting mismatched passwords and then resubmitting with matching passwords.
Description
An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's account and reset the user's group mappings, username, and password, as demonstrated by submitting a form that targets the `registration.register` task.
Exploits (2)
This exploit leverages a vulnerability in Joomla! <= 3.6.4 to take over an admin account by manipulating the registration form to associate a new user with an existing admin ID. It bypasses password validation by first submitting mismatched passwords and then resubmitting with matching passwords.
This repository provides a Dockerized environment for Joomla 3.6.4, which is vulnerable to CVE-2016-9838. The setup includes a pre-configured Joomla installation with a database, allowing for testing of the vulnerability in an isolated container.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N