Create CVE-2016-8870.yaml

2026-11-12 12:12:17 -10:00 · 2026-11-12 13:58:44 +05:30
1 changed files with 63 additions and 0 deletions
@@ -0,0 +1,63 @@
+id: CVE-2016-8870
+
+info:
+  name: Joomla! - Authentication Bypass
+  author: ritikchaddha
+  severity: high
+  description: |
+    Joomla! CMS 3.4.4 through 3.6.3 contains a leftover UsersControllerUser::register method in components/com_users/controllers/user.php that does not check the Allow User Registration setting. An unauthenticated attacker can create user accounts by posting to /index.php?option=com_users&task=User.register even when registration is disabled. CVE-2016-8869 is a related privilege-escalation issue on the same endpoint (custom group/id values). This template is version-based: it reads the public Joomla manifest and flags releases in the affected range. It does not submit a registration request and will not create accounts. A match means the site is running a vulnerable Joomla version, not that a new account was created. Fixed in Joomla 3.6.4 by removing the leftover register method.
+  impact: |
+    An unauthenticated attacker can create user accounts when registration has been disabled. Combined with CVE-2016-8869, the same endpoint can be abused to assign elevated groups or overwrite existing users.
+  remediation: |
+    Upgrade Joomla! to version 3.6.4 or later. After upgrading, review user accounts for unauthorized registrations created before the patch.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-8870
+    - https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html
+    - https://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf
+    - https://www.fortinet.com/blog/threat-research/joomla-from-no-one-to-the-highest-privilege
+    - https://blog.scrt.ch/2016/11/10/joomla-admin-user-creation-3-4-4-%E2%86%92-3-6-3/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2016-8870
+    cwe-id: CWE-20
+    epss-score: 0.81136
+    epss-percentile: 0.99639
+    cpe: cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: joomla
+    product: joomla\!
+    shodan-query:
+      - http.html:"Joomla! - Open Source Content Management"
+      - http.component:"Joomla"
+    fofa-query: body="Joomla! - Open Source Content Management"
+  tags: cve,cve2016,joomla,cms,auth-bypass,passive
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/administrator/manifests/files/joomla.xml"
+
+    extractors:
+      - type: regex
+        name: version
+        group: 1
+        regex:
+          - '<version>([0-9]+\.[0-9]+(?:\.[0-9]+)?)</version>'
+        internal: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "files_joomla"
+          - "<version>"
+        condition: and
+
+      - type: dsl
+        dsl:
+          - 'compare_versions(version, ">= 3.4.4")'
+          - 'compare_versions(version, "<= 3.6.3")'
+        condition: and