Zero-day published for old Joomla CMS versions

Joomla
Image: Joomla team

Details have been published online last week about a vulnerability in older versions of the Joomla content management system (CMS), a popular web-based application for building and managing websites.

The vulnerability was discovered by Italian security researcher Alessandro Groppo of Hacktive Security, and impacts all Joomla versions from 3.0.0 to 3.4.6, released between late September 2012 to mid-December 2015.

The vulnerability is trivial to exploit, and proof-of-concept exploit code has been published online.

It’s a PHP object injection that can lead to remote code execution (RCE) under certain scenarios. For example, it can be exploited via the Joomla CMS’ login form and can allow attackers to execute code on the site’s underlying server.

Coinbase 2

Similar to an older 2015 Joomla zero-day

Groppo said the vulnerability is similar to CVE-2015-8562, another PHP object injection that can lead to remote code execution, although they are not related.

CVE-2015-8562 is a well-known Joomla exploit that’s being abused even to this day. When it was discovered in December 2015, the vulnerability was a zero-day, and hackers were abusing it in the wild to take over sites.

The difference between Groppo’s discovery and the 2015 vulnerability is that the newer one impacts a smaller number of Joomla sites, only Joomla 3.x versions, while CVE-2015-8562 impacted all Joomla versions available at the time — 1.5.x, 2.x, and 3.x branches.

However, despite affecting a smaller number of sites, Groppo’s vulnerability has a wider impact, as it’s “completely independent from the [server] environment,” compared to the older release, which only worked against servers running a PHP version before 5.4.45, 5.5.29 or 5.6.13.

The good news is that Joomla developers appear to have fixed the issue at the core of Groppo’s zero-day a release after they fixed CVE-2015-8562.

Many website owners run outdated CMS versions due to plugin and theme incompatibilities that can lead to site breakage; however, they don’t need to update all the way to the latest release to be protected — albeit that would be a much better solution.

Updating to any Joomla version of 3.4.7 or later will prevent attacks. The current Joomla version is 3.9.12.

Groppo’s zero-day doesn’t yet have a CVE identifier. A demo showing the zero-day in action is embedded below. A technical explanation is available on Groppo’s blog, while proof-of-concept code was uploaded on Exploit-DB last week.

[embedded content]

Zero-day published for old Joomla CMS versions 1
About the author

E-Crypto News was developed to assist all cryptocurrency investors in developing profitable cryptocurrency portfolios through the provision of timely and much-needed information. Investments in cryptocurrency require a level of detail, sensitivity, and accuracy that isn’t required in any other market and as such, we’ve developed our databases to help fill in information gaps.

Related Posts

E-Crypto News Executive Interviews



bitcoin
Bitcoin (BTC) $ 47,657.00
ethereum
Ethereum (ETH) $ 3,582.49
cardano
Cardano (ADA) $ 2.43
tether
Tether (USDT) $ 1.00
binance-coin
Binance Coin (BNB) $ 423.50
xrp
XRP (XRP) $ 1.10
solana
Solana (SOL) $ 154.50
polkadot
Polkadot (DOT) $ 34.84
dogecoin
Dogecoin (DOGE) $ 0.239806
usd-coin
USD Coin (USDC) $ 1.00
USD
EUR
GBP
bitcoinBitcoin (BTC)
$ 47,657.00
ethereumEthereum (ETH)
$ 3,582.49
tetherTether (USDT)
$ 1.00
bitcoin-cashBitcoin Cash (BCH)
$ 632.83
litecoinLitecoin (LTC)
$ 187.67
bitcoinBitcoin (BTC)
40.306,15
ethereumEthereum (ETH)
3.029,91
tetherTether (USDT)
0,845755
bitcoin-cashBitcoin Cash (BCH)
535,22
litecoinLitecoin (LTC)
158,72
bitcoinBitcoin (BTC)
34,349.97
ethereumEthereum (ETH)
2,582.17
tetherTether (USDT)
0.720775
bitcoin-cashBitcoin Cash (BCH)
456.13
litecoinLitecoin (LTC)
135.27

Automated trading with HaasBot Crypto Trading Bots

Crypto Scams

Crypto Scams
Crypto Scams Still Persistent In 2021, SEC Warns About Red Flags To Watch
September 9, 2021
Poly Network
Here’s How Hackers Stole Over $600 million in the Poly Network Attack
August 12, 2021
The World’s Most Infamous Crypto Hacks and Scams
July 31, 2021
Cryptocurrency Exchanges
Cryptocurrency Exchanges and the Plague of Scams and Bans
June 29, 2021
What Role Do Cryptocurrencies Play In The Era Of Ransomware Attacks?
June 9, 2021

Blockchain/Cryptocurrency Questions and Answers

Beginner’s Guide to Investing in Cryptocurrency
August 9, 2021
Short-Sell Cryptocurrency
How to Short-Sell Cryptocurrency: A Brief Overview
July 17, 2021
Klaytn
What Is Klaytn (KLAY) And How Does It Work?
July 16, 2021
Cryptocurrencies
Our Crypto Roundup Interview Asks- Do Cryptocurrencies Have a Future?
July 15, 2021
Solana
What Is Solana (SOL) And How Does It Work?
June 26, 2021


CryptoCurrencyUSDChange 1hChange 24hChange 7d
Bitcoin47,775 0.54 % 0.91 % 3.67 %
Ethereum3,595.8 0.85 % 2.91 % 2.83 %
Cardano2.450 1.39 % 3.92 % 1.07 %
Tether0.9986 0.03 % 0.08 % 0.23 %
Binance Coin424.62 0.17 % 2.46 % 2.56 %
XRP1.100 0.44 % 0.80 % 0.55 %
Solana155.18 0.07 % 3.20 % 18.05 %
Polkadot30.87 2.19 % 17.29 % 10.73 %
Dogecoin0.2407 0.61 % 1.85 % 6.19 %
USD Coin1.000 0.01 % 0.18 % 0.16 %

bitcoin
Bitcoin (BTC) $ 47,657.00
ethereum
Ethereum (ETH) $ 3,582.49
cardano
Cardano (ADA) $ 2.43
tether
Tether (USDT) $ 1.00
binance-coin
Binance Coin (BNB) $ 423.50
xrp
XRP (XRP) $ 1.10
solana
Solana (SOL) $ 154.50
polkadot
Polkadot (DOT) $ 34.84
dogecoin
Dogecoin (DOGE) $ 0.239806
usd-coin
USD Coin (USDC) $ 1.00