0

I am having problems with the exploit

**Joomla! 1.0 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution
CVE : CVE-2015-8562 , CVE-2015-8566**

It doesn't work on Joomla versions < 3.0

So in order to investigate the problem i installed Xampp on Kali, then i installed two different versions of Joomla, namely version 2.5.8 and 3.4.3

After i ran the exploit i noticed the difference in sessions and i never figured out why.

version 2.5.8

__default|a:7:

version 3.4.3

__default|a:9:

I opened mysql.php from both versions and i noticed the part which i think might be the cause of the problem

version 2.5.8

public function __destruct()
    {
        if (is_resource($this->connection))
        {
            mysql_close($this->connection);
        }
    }

version 3.4.3

public function __destruct()
    {
        $this->disconnect();
    }

then the disconnect()

public function disconnect()
{
    // Close the connection.
    if (is_resource($this->connection))
    {
        foreach ($this->disconnectHandlers as $h)
        {
            call_user_func_array($h, array( &$this));
        }

        mysql_close($this->connection);
    }

    $this->connection = null;
}

Its above my knowledge but i can see that the part \0\0\0disconnectHandlers from the exploit is somehow related to version 3.Xs. I also wanted to add the above version 3 code to version 2 and see if it works but first i need to know if there is another way to make it work.

My question: Is there a way to substitute \0\0\0disconnectHandlers in the exploit CVE-2015-8566 or anything that might help?

Thank you

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.