Zero-day vulnerability in Joomla!

Remote PHP code execution

The vulnerability was used to compromise vulnerable websites for 16000 (sometimes - 20000) times per day.

Vulnerability details

Advisory: SB2015121401 - Remote PHP code execution in Joomla!

Vulnerable component: Joomla!

CVE-ID: CVE-2015-8562

CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')


The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to insufficient filtration of HTTP User-Agent header and filter-search HTTP POST parameter before storing them into database. A remote unauthenticated attacker can permanently inject and execute arbitrary PHP code on the target system with privileges of the web server.

Successful exploitation of this vulnerability will allow a remote attacker to gain complete control over the vulnerable web application and execute arbitrary PHP code on the target system.

Note: this is a zero-day vulnerability and it is being exploited in the wild.

Public Exploits:

Vulnerability Scanning SaaS

Vulnerability scanning SaaS service is online 3-rd generation vulnerability scanner with scheduled assessments and vulnerability subscription. You can use service to check security of your network perimeter.