CVE-2016-8869

🗓️ 04 Nov 2016 21:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 165 Views🌐 WEB

CVE-2016-8869 allows remote attackers to gain privileges via unfiltered data in Joomla! before 3.6.4.

Reporter	Title	Published	Views	Family All 29
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	23 Feb 201812:32	–	gitee
Gitee	Exploit for OS Command Injection in Gnu Bash	27 Jul 202504:29	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	13 Sep 202011:52	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	21 Oct 202022:39	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	11 Mar 202001:42	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	9 Oct 201917:20	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	26 May 202023:42	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	27 Jul 202503:43	–	gitee
0day.today	Joomla 3.4.4 - 3.6.4 - Account Creation / Privilege Escalation Exploit	27 Oct 201600:00	–	zdt
Circl	CVE-2016-8869	27 Oct 201622:27	–	circl

NVD

Node

joomla joomla!Range≤3.6.3

Source	Link
securityfocus	www.securityfocus.com/bid/93883
exploit-db	www.exploit-db.com/exploits/40637/
developer	www.developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html
rapid7	www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc
medium	www.medium.com/%40showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2
blog	www.blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html
github	www.github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf
securitytracker	www.securitytracker.com/id/1037108

Parameter	Position	Path	Description	CWE
jform	path	index.php/component/users/?task=registration.register	Privilege escalation via registration flow by submitting a crafted request to registration.register that manipulates user groups.	CWE-20
user[groups][]	path	index.php/component/users/?task=registration.register	Privilege escalation via registration flow by submitting a crafted request to registration.register that manipulates user groups.	CWE-20
user[groups][]	path	index.php/component/users/?task=user.register	Privilege escalation by submitting crafted user data to user.register to elevate privileges (Administrator) during account creation.	CWE-20
user[activation]	path	index.php/component/users/?task=user.register	Privilege escalation by submitting crafted user data to user.register to elevate privileges (Administrator) during account creation.	CWE-20
user[block]	path	index.php/component/users/?task=user.register	Privilege escalation by submitting crafted user data to user.register to elevate privileges (Administrator) during account creation.	CWE-20

17 Jun 2026 00:55Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 39.8

EPSS0.97426