Yesterday, Melvin Lammerts wrote an article on the account creation with elevated privileges vulnerability in Joomla! < 3.6.4. And included a PoC exploit. This Joomla! vulnerability makes it easy for an attacker to create an user account, even when user registration is turned off. Yikes!
Yesterday Joomla published version 3.6.4, an update to patch security issues. Because I was curious to see how these vulnerabilities worked I decided to check out the patch and write an exploit. By looking at the changes, the issue had to be in the components/com_users/controllers/user.php file.
Turns out the register method of UsersControllerUser had been removed completely. Interesting. So I installed my own Joomla at version 3.6.3 and noticed that registrations are usually done with the following request: