{"vulnerability": "CVE-2015-8562", "sightings": [{"uuid": "36b5d1c9-0ca6-4ad5-83da-eda20bcb0058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "MISP/57344868-a120-4004-90f6-4c49950d210f", "content": "", "creation_timestamp": "2016-05-12T09:12:03.000000Z"}, {"uuid": "61bbf6c5-c890-4b63-861b-49f31f93a474", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://www.exploit-db.com/exploits/38977", "content": "", "creation_timestamp": "2015-12-15T00:00:00.000000Z"}, {"uuid": "065dd4d3-ba0b-4234-9da4-b19c0f4ab0b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "85a6bb97-a48d-4780-af7a-f88d71a83e08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:43.000000Z"}, {"uuid": "ae935b4c-5261-42f5-a40a-b1e9704c9529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/joomla_http_header_rce.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "b8a9abb9-da69-4bdc-bebf-27fffa9a3e37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "published-proof-of-concept", "source": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/google/detectors/rce/joomla/cve20158562", "content": "", "creation_timestamp": "2021-02-05T21:43:47.000000Z"}, {"uuid": "966a4ef2-e5af-4fac-bf0a-9e25c0f0ed0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "published-proof-of-concept", "source": "Telegram/5XGpncEfRIuewYJEc34aWTFVRwMO65Yc4SMMQva9F06aJhs", "content": "", "creation_timestamp": "2025-07-13T21:00:04.000000Z"}, {"uuid": "16d0b9f2-512c-43b6-82b8-149ff737ce74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://t.me/arpsyndicate/1570", "content": "#ExploitObserverAlert\n\nCVE-2015-8562\n\nDESCRIPTION: Exploit Observer has 42 entries related to CVE-2015-8562. Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.\n\nFIRST-EPSS: 0.971900000\nNVD-IS: 6.4\nNVD-ES: 10.0", "creation_timestamp": "2023-12-08T13:45:10.000000Z"}, {"uuid": "31e81e26-5f30-4697-95c3-77e796cbe85c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-08)", "content": "", "creation_timestamp": "2026-08-09T11:43:04.990316Z"}, {"uuid": "e2bb6347-abc0-4aa0-a4da-d66a21afb573", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ef8abf2b-68d3-4fc7-ad1f-6ec995305355", "content": "", "creation_timestamp": "2026-06-19T16:45:34.698694Z"}, {"uuid": "73972342-401e-4d73-9641-297b2db98c7a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/da7b4e3b-1802-41d3-8dd8-2deeda750be4", "content": "", "creation_timestamp": "2026-06-23T14:04:06.768872Z"}, {"uuid": "08ee5c98-f7d3-4d74-8ad7-5ed09dafe1ff", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/da9dfb3d-1712-4941-8114-ffd60a28f73c", "content": "", "creation_timestamp": "2026-06-30T12:40:26.737232Z"}, {"uuid": "3d4f9888-59aa-4fff-ab88-3fe5055cfd21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-27)", "content": "", "creation_timestamp": "2026-07-28T10:15:24.042359Z"}, {"uuid": "d2e4d1fc-c952-4880-bb3b-50ce96177d5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "published-proof-of-concept", "source": "Telegram/gaBdUAEEWVgUcYnHku1FjILsSJN1BtvDBCiJZ9Y-qG01X4M", "content": "", "creation_timestamp": "2026-09-02T01:00:04.236223Z"}, {"uuid": "88957155-c62f-446a-be5a-82fd36478689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "published-proof-of-concept", "source": "Telegram/gaBdUAEEWVgUcYnHku1FjILsSJN1BtvDBCiJZ9Y-qG01X4M", "content": "", "creation_timestamp": "2026-09-03T00:00:59.806806Z"}, {"uuid": "5f6c90ac-2e3e-47b0-9aec-697e333e738d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/joomla_http_header_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Marc-Alexandre Montpas\", \"Christian Mehlmauer \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5.0 to 3.4.5.\\n          By storing user supplied headers in the databases session table it's possible to truncate the input\\n          by sending an UTF-8 character. The custom created payload is then executed once the session is read\\n          from the database. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13.\\n          In later versions the deserialisation of invalid session data stops on the first error and the\\n          exploit will not work. The PHP Patch was included in Ubuntu versions 5.5.9+dfsg-1ubuntu4.13 and\\n          5.3.10-1ubuntu3.20 and in Debian in version 5.4.45-0+deb7u1.\", \"disclosure_date\": \"2015-12-14\", \"fullname\": \"exploit/multi/http/joomla_http_header_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"Joomla HTTP Header Unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/joomla_http_header_rce.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/joomla_http_header_rce\", \"references\": [\"CVE-2015-8562\", \"EDB-38977\", \"EDB-39033\", \"URL-http://web.archive.org/web/20250117165939/https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html\", \"URL-http://web.archive.org/web/20250220041731/https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html\", \"URL-https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html\", \"URL-https://blog.patrolserver.com/2015/12/17/in-depth-analyses-of-the-joomla-0-day-user-agent-exploit/\", \"URL-https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F11330\", \"URL-https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fwww.freebuf.com%2Fvuls%2F89754.html\", \"URL-https://bugs.php.net/bug.php?id=70219\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Joomla 1.5.0 - 3.4.5\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:00.061016Z"}]}