CVE-2016-8870
82Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 81%
da publicação à arma0 dias
Publicada no NVD4 de nov.
1ª PoC27 de out.
metasploit25 de out.
VulnCheck28 de out.
probabilidade de exploração
81%top 1% das CVEs
exploração observada
simVulnCheck
3 exploit(s) público(s)
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.
Produtos afetados
n/a · n/aPoCs públicas encontradas — 3
exploitdbwww.exploit-db.com/exploits/40637não verificadogithubgithub.com/cved-sources/cve-2016-8870★ 0cve_referencewww.exploit-db.com/exploits/40637/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.htmlhttps://developer.joomla.org/security-centre/659-20161001-core-account-creation.htmlhttps://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcfhttps://medium.com/%40showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.rq4qh1v4rhttps://www.exploit-db.com/exploits/40637/http://www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_priveschttp://www.securityfocus.com/bid/93876http://www.securitytracker.com/id/1037107http://www.securitytracker.com/id/1037108