CVE-2015-8562

Joomla HTTP Header Unauthenticated Remote Code Execution

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.

Joomla! 1.5.x, 2.x y 3.x en versiones anteriores a 3.4.6 permite a atacantes remotos llevar a cabo ataques de inyección de objetos PHP y ejecutar código PHP arbitrario a través de la cabecera HTTP User-Agent header, como fue explotado en Diciembre 2015.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-12-14 First Exploit
2015-12-15 CVE Reserved
2015-12-16 CVE Published
2024-08-06 CVE Updated
2024-08-22 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation

CAPEC

References (19)

URL	Tag	Source
http://packetstormsecurity.com/files/135100/Joomla-3.4.5-Object-Injection.html	X_refsource_misc
http://www.rapid7.com/db/modules/exploit/multi/http/joomla_http_header_rce	X_refsource_misc
http://www.securityfocus.com/archive/1/537219/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/79195	Vdb Entry
https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html
https://blog.patrolserver.com/2015/12/17/in-depth-analyses-of-the-joomla-0-day-user-agent-exploit
https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F11330
https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fwww.freebuf.com%2Fvuls%2F89754.html
https://bugs.php.net/bug.php?id=70219

URL	Date	SRC
https://www.exploit-db.com/exploits/38977	2024-08-06
https://www.exploit-db.com/exploits/39033	2024-08-06
https://github.com/paralelo14/CVE-2015-8562	2017-01-08
https://github.com/guanjivip/CVE-2015-8562	2020-07-25
https://github.com/thejackerz/scanner-exploit-joomla-CVE-2015-8562	2016-06-08
https://github.com/RobinHoutevelts/Joomla-CVE-2015-8562-PHP-POC	2016-01-05
http://packetstormsecurity.com/files/134949/Joomla-HTTP-Header-Unauthenticated-Remote-Code-Execution.html	2024-08-06
https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html	2024-08-06
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/joomla_http_header_rce.rb	2015-12-14

URL	Date	SRC

URL	Date	SRC
https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html	2015-12-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.0 Search vendor "Joomla" for product "Joomla\!" and version "1.5.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.1 Search vendor "Joomla" for product "Joomla\!" and version "1.5.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.2 Search vendor "Joomla" for product "Joomla\!" and version "1.5.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.3 Search vendor "Joomla" for product "Joomla\!" and version "1.5.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.4 Search vendor "Joomla" for product "Joomla\!" and version "1.5.4"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.6 Search vendor "Joomla" for product "Joomla\!" and version "1.5.6"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.7 Search vendor "Joomla" for product "Joomla\!" and version "1.5.7"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.8 Search vendor "Joomla" for product "Joomla\!" and version "1.5.8"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.9 Search vendor "Joomla" for product "Joomla\!" and version "1.5.9"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.10 Search vendor "Joomla" for product "Joomla\!" and version "1.5.10"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.11 Search vendor "Joomla" for product "Joomla\!" and version "1.5.11"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.12 Search vendor "Joomla" for product "Joomla\!" and version "1.5.12"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.13 Search vendor "Joomla" for product "Joomla\!" and version "1.5.13"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.14 Search vendor "Joomla" for product "Joomla\!" and version "1.5.14"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.15 Search vendor "Joomla" for product "Joomla\!" and version "1.5.15"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.16 Search vendor "Joomla" for product "Joomla\!" and version "1.5.16"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.17 Search vendor "Joomla" for product "Joomla\!" and version "1.5.17"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.18 Search vendor "Joomla" for product "Joomla\!" and version "1.5.18"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.19 Search vendor "Joomla" for product "Joomla\!" and version "1.5.19"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.20 Search vendor "Joomla" for product "Joomla\!" and version "1.5.20"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.21 Search vendor "Joomla" for product "Joomla\!" and version "1.5.21"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.22 Search vendor "Joomla" for product "Joomla\!" and version "1.5.22"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.23 Search vendor "Joomla" for product "Joomla\!" and version "1.5.23"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.24 Search vendor "Joomla" for product "Joomla\!" and version "1.5.24"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.25 Search vendor "Joomla" for product "Joomla\!" and version "1.5.25"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.5.26 Search vendor "Joomla" for product "Joomla\!" and version "1.5.26"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.6.0 Search vendor "Joomla" for product "Joomla\!" and version "1.6.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.6.1 Search vendor "Joomla" for product "Joomla\!" and version "1.6.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.6.2 Search vendor "Joomla" for product "Joomla\!" and version "1.6.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.6.3 Search vendor "Joomla" for product "Joomla\!" and version "1.6.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.6.4 Search vendor "Joomla" for product "Joomla\!" and version "1.6.4"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.6.5 Search vendor "Joomla" for product "Joomla\!" and version "1.6.5"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.6.6 Search vendor "Joomla" for product "Joomla\!" and version "1.6.6"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.7.0 Search vendor "Joomla" for product "Joomla\!" and version "1.7.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.7.1 Search vendor "Joomla" for product "Joomla\!" and version "1.7.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.7.2 Search vendor "Joomla" for product "Joomla\!" and version "1.7.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.7.3 Search vendor "Joomla" for product "Joomla\!" and version "1.7.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.7.4 Search vendor "Joomla" for product "Joomla\!" and version "1.7.4"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				1.7.5 Search vendor "Joomla" for product "Joomla\!" and version "1.7.5"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.0 Search vendor "Joomla" for product "Joomla\!" and version "2.5.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.1 Search vendor "Joomla" for product "Joomla\!" and version "2.5.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.2 Search vendor "Joomla" for product "Joomla\!" and version "2.5.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.3 Search vendor "Joomla" for product "Joomla\!" and version "2.5.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.4 Search vendor "Joomla" for product "Joomla\!" and version "2.5.4"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.5 Search vendor "Joomla" for product "Joomla\!" and version "2.5.5"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.6 Search vendor "Joomla" for product "Joomla\!" and version "2.5.6"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.7 Search vendor "Joomla" for product "Joomla\!" and version "2.5.7"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.8 Search vendor "Joomla" for product "Joomla\!" and version "2.5.8"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.9 Search vendor "Joomla" for product "Joomla\!" and version "2.5.9"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.10 Search vendor "Joomla" for product "Joomla\!" and version "2.5.10"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.11 Search vendor "Joomla" for product "Joomla\!" and version "2.5.11"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.12 Search vendor "Joomla" for product "Joomla\!" and version "2.5.12"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.13 Search vendor "Joomla" for product "Joomla\!" and version "2.5.13"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.14 Search vendor "Joomla" for product "Joomla\!" and version "2.5.14"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.15 Search vendor "Joomla" for product "Joomla\!" and version "2.5.15"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.16 Search vendor "Joomla" for product "Joomla\!" and version "2.5.16"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.17 Search vendor "Joomla" for product "Joomla\!" and version "2.5.17"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.18 Search vendor "Joomla" for product "Joomla\!" and version "2.5.18"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.19 Search vendor "Joomla" for product "Joomla\!" and version "2.5.19"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.20 Search vendor "Joomla" for product "Joomla\!" and version "2.5.20"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.21 Search vendor "Joomla" for product "Joomla\!" and version "2.5.21"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.22 Search vendor "Joomla" for product "Joomla\!" and version "2.5.22"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.23 Search vendor "Joomla" for product "Joomla\!" and version "2.5.23"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.24 Search vendor "Joomla" for product "Joomla\!" and version "2.5.24"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.25 Search vendor "Joomla" for product "Joomla\!" and version "2.5.25"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.26 Search vendor "Joomla" for product "Joomla\!" and version "2.5.26"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.27 Search vendor "Joomla" for product "Joomla\!" and version "2.5.27"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				2.5.28 Search vendor "Joomla" for product "Joomla\!" and version "2.5.28"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.0.0 Search vendor "Joomla" for product "Joomla\!" and version "3.0.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.0.1 Search vendor "Joomla" for product "Joomla\!" and version "3.0.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.0.2 Search vendor "Joomla" for product "Joomla\!" and version "3.0.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.0.3 Search vendor "Joomla" for product "Joomla\!" and version "3.0.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.1.0 Search vendor "Joomla" for product "Joomla\!" and version "3.1.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.1.1 Search vendor "Joomla" for product "Joomla\!" and version "3.1.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.1.2 Search vendor "Joomla" for product "Joomla\!" and version "3.1.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.1.3 Search vendor "Joomla" for product "Joomla\!" and version "3.1.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.1.4 Search vendor "Joomla" for product "Joomla\!" and version "3.1.4"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.1.5 Search vendor "Joomla" for product "Joomla\!" and version "3.1.5"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.1.6 Search vendor "Joomla" for product "Joomla\!" and version "3.1.6"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.2.0 Search vendor "Joomla" for product "Joomla\!" and version "3.2.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.2.1 Search vendor "Joomla" for product "Joomla\!" and version "3.2.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.2.2 Search vendor "Joomla" for product "Joomla\!" and version "3.2.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.2.3 Search vendor "Joomla" for product "Joomla\!" and version "3.2.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.2.4 Search vendor "Joomla" for product "Joomla\!" and version "3.2.4"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.3.0 Search vendor "Joomla" for product "Joomla\!" and version "3.3.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.3.1 Search vendor "Joomla" for product "Joomla\!" and version "3.3.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.3.2 Search vendor "Joomla" for product "Joomla\!" and version "3.3.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.3.3 Search vendor "Joomla" for product "Joomla\!" and version "3.3.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.3.4 Search vendor "Joomla" for product "Joomla\!" and version "3.3.4"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.4.0 Search vendor "Joomla" for product "Joomla\!" and version "3.4.0"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.4.1 Search vendor "Joomla" for product "Joomla\!" and version "3.4.1"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.4.2 Search vendor "Joomla" for product "Joomla\!" and version "3.4.2"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.4.3 Search vendor "Joomla" for product "Joomla\!" and version "3.4.3"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.4.4 Search vendor "Joomla" for product "Joomla\!" and version "3.4.4"		-		Affected
Joomla Search vendor "Joomla"		Joomla\! Search vendor "Joomla" for product "Joomla\!"				3.4.5 Search vendor "Joomla" for product "Joomla\!" and version "3.4.5"		-		Affected