Yesterday, Melvin Lammerts wrote an article on the account creation with elevated privileges vulnerability in Joomla! < 3.6.4. And included a PoC exploit. This Joomla! vulnerability makes it easy for an attacker to create an user account, even when user registration is turned off. Yikes!
Yesterday Joomla published version 3.6.4, an update to patch security issues. Because I was curious to see how these vulnerabilities worked I decided to check out the patch and write an exploit. By looking at the changes, the issue had to be in the
Turns out the register method of
UsersControllerUserhad been removed completely. Interesting. So I installed my own Joomla at version 3.6.3 and noticed that registrations are usually done with the following request:
Have you ditched^Wupdated Joomla! yet? Tip, improve Joomla! performance easily!
If you want to step in to help me cover the costs for running this website, that would be awesome. Just use this link to donate a cup of coffee ($5 USD for example). And please share the love and help others make use of this website. Thank you very much!
My name is Jan. I am not a hacker, coder, developer, programmer or guru. I am merely a system administrator, doing my daily thing at Vevida in the Netherlands. With over 15 years of experience, my specialties include Windows Server, IIS, Linux (CentOS, Debian), security, PHP, websites & optimization.
“How we broke PHP, hacked Pornhub and earned $20,000”
.NET Framework 4.6 allows side loading of Windows API Set DLL
Microsoft warns for PowerPoint OLE 0-day
“Simple Hack Threatens Outdated Joomla Sites”
A Penetration Tester’s Guide to IPMI and BMCs
A cheat-sheet for password crackers