Vulnerability Details : CVE-2015-7857
Public exploit exists!
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
Vulnerability category: Sql Injection
Products affected by CVE-2015-7857
- cpe:2.3:a:joomla:joomla\!:3.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:joomla:joomla\!:3.4.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-7857
77.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2015-7857
-
Joomla Content History SQLi Remote Code Execution
Disclosure Date: 2015-10-23First seen: 2020-04-26exploit/unix/webapp/joomla_contenthistory_sqli_rceThis module exploits a SQL injection vulnerability found in Joomla versions 3.2 up to 3.4.4. The vulnerability exists in the Content History administrator component in the core of Joomla. Triggering the SQL injection makes it possible to retrieve active Super User se
CVSS scores for CVE-2015-7857
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2015-7857
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7857
-
https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/
Joomla SQL Injection Vulnerability Exploit Results in Full Administrative Access | Trustwave | SpiderLabs | TrustwaveExploit
-
http://www.securityfocus.com/bid/77295
Joomla! Core Multiple SQL Injection Vulnerabilities
-
http://www.securitytracker.com/id/1033950
Joomla! Core Bugs Let Remote Users Bypass Access Controls and Inject SQL Commands - SecurityTracker
-
http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html
Joomla 3.44 SQL Injection ≈ Packet Storm
-
http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html
[20151001] - Core - SQL Injection
-
https://www.exploit-db.com/exploits/38797/
Joomla! 3.4.4 Component Content History - SQL Injection / Remote Code Execution (Metasploit)
-
http://www.rapid7.com/db/modules/exploit/unix/webapp/joomla_contenthistory_sqli_rce
Joomla Content History SQLi Remote Code Execution
-
http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html
Joomla Content History SQL Injection Remote Code Execution ≈ Packet Storm
Jump to