CVE-2015-8562

Description

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.

References

https://github.com/514-koishi-514/Kintsugi_CVE

https://github.com/DaDecky/kpl-cve-vuln-pocs

https://github.com/lorenzodegiorgi/setup-cve-2015-8562

https://github.com/xnorkl/Joomla_Payload

https://github.com/VoidSec/Joomla_CVE-2015-8562

https://github.com/atcasanova/cve-2015-8562-exploit

https://github.com/paralelo14/JoomlaMassExploiter

https://github.com/RobinHoutevelts/Joomla-CVE-2015-8562-PHP-POC

https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html

http://www.securityfocus.com/bid/79195

http://www.securityfocus.com/archive/1/537219/100/0/threaded

http://packetstormsecurity.com/files/135100/Joomla-3.4.5-Object-Injection.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS