Zero-Day Issued for Old Joomla CMS versions – Online Proof-of-Concept Code Available

mood · Oct 8, 2019

Zero-Day Issued for Old CMS – Online Proof-of-Concept Code Available
October 8, 2019
https://hackercombat.com/zero-day-issued-for-old-cms-online-proof-of-concept-code-available/

The bug has been discovered by Hacktive Security Italian security researcher Alessandro Groppo. It affects all versions of Joomla released from late September 2012 to mid-December 2015 from 3.0.0 to 3.4.6.
The vulnerability is easy to exploit and the code of attack proof of concept was published online.

Groppo said CVE-2015-8562, an additional PHP object injection that could lead to remote code execution even if not linked, is similar to that vulnerability.
Most website owners run obsolete CMS versions due to module or subject incompatibilities that can destroy the site; however, they don’t have to patch the last release in order to be safeguarded–although this would be a much better solution.

Every edition of Joomla 3.4.7 and later is patched to prevent attacks. The current version of Joomla is 3.9.12.
Groppo’s zero-day has no CVE detection whatsoever.
Click to expand...

Hacktive Security Blog: Rusty Joomla RCE

Log in or Sign up

Zero-Day Issued for Old Joomla CMS versions – Online Proof-of-Concept Code Available

mood Updates Team

Severe Netsweeper zero-day leaves gaping hole in users’ networks

Dashboard: Zero-Days in Desktop Web Browsers

Zoho zero-day published on Twitter

Dropbox Zero-Day Vulnerability Gets Temporary Fix

Atlassian scrambles to fix zero-day security hole accidentally disclosed on Twitter

Log in or Sign up

Zero-Day Issued for Old Joomla CMS versions – Online Proof-of-Concept Code Available

mood Updates Team

Severe Netsweeper zero-day leaves gaping hole in users’ networks

Dashboard: Zero-Days in Desktop Web Browsers

Zoho zero-day published on Twitter

Dropbox Zero-Day Vulnerability Gets Temporary Fix

Atlassian scrambles to fix zero-day security hole accidentally disclosed on Twitter

Useful Searches