PT-2016-7836 · Joomla · Joomla! Cms

Published 2016-12-05 · Updated 2016-12-07 · CVE-2016-9836

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! CMS versions prior to 3.6.5

Description The issue concerns the file scanning mechanism in Joomla! CMS, specifically the JFilterInput::isFileSafe() function, which fails to account for alternative PHP file extensions when checking uploaded files for PHP content. This allows users to upload and execute files with extensions such as .php6, .php7, .phtml, and .phpt. Furthermore, the JHelperMedia::canUpload() function did not properly blacklist these file extensions as uploadable file types.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-9836

Affected Products

Joomla! Cms

References · 5

• 🔥 https://github.com/XiphosResearch/exploits/tree/master/Joomraa · Exploit
• https://osv.dev/vulnerability/CVE-2016-9836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9836 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9836 · Note
• http://securityfocus.com/bid/94663 · Note