CVE-2016-8869

🗓️ 04 Nov 2016 21:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 178 Views🌐 WEB

CVE-2016-8869 allows remote attackers to gain privileges via unfiltered data in Joomla! before 3.6.4.

Reporter	Title	Published	Views	Family All 30
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	23 Feb 201812:32	–	gitee
Gitee	Exploit for OS Command Injection in Gnu Bash	27 Jul 202504:29	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	13 Sep 202011:52	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	21 Oct 202022:39	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	11 Mar 202001:42	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	9 Oct 201917:20	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	26 May 202023:42	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	27 Jul 202503:43	–	gitee
zdt	Joomla 3.4.4 - 3.6.4 - Account Creation / Privilege Escalation Exploit	27 Oct 201600:00	–	zdt
Circl	CVE-2016-8869	27 Oct 201622:27	–	circl

NVD

Node

joomla joomla!Range≤3.6.3

Source	Link
securityfocus	www.securityfocus.com/bid/93883
exploit-db	www.exploit-db.com/exploits/40637/
developer	www.developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html
rapid7	www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc
medium	www.medium.com/%40showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2
blog	www.blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html
github	www.github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf
securitytracker	www.securitytracker.com/id/1037108

Parameter	Position	Path	Description	CWE
jform[name]	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
jform[username]	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
jform[password1]	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
jform[password2]	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
jform[email1]	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
jform[email2]	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
option	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
task	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
yourtoken	request body	index.php/component/users/?task=registration.register	Privilege escalation via unauthenticated control of registration data (CWE-20) in Joomla registration flow (CVE-2016-8869)	CWE-20
user[name]	request body	index.php/component/users/?task=user.register	Privilege escalation by assigning Administrator group during user.registration (CVE-2016-8869)	CWE-20

17 Jun 2026 00:55Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 39.8

EPSS0.97426

CWE-20

joomla vulnerability remote access privilege escalation unfiltered data