Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:MISC:JOOMLA-UNSER-CE |
|---|---|
Severity |
Major |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Joomla Akeeba Kickstart Unserialize Remote Code Execution |
Release Date |
2015/06/09 |
Update Number |
2503 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Joomla Akeeba Kickstart Unserialize Remote Code Execution
This signature detects attempts to exploit a known vulnerability against Joomla web application. A successful attack can lead to arbitrary code execution.
Extended Description
Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.
Affected Products
- Joomla joomla! 2.5.10
- Joomla joomla! 2.5.11
- Joomla joomla! 2.5.12
- Joomla joomla! 2.5.13
- Joomla joomla! 2.5.14
- Joomla joomla! 2.5.15
- Joomla joomla! 2.5.16
- Joomla joomla! 2.5.17
- Joomla joomla! 2.5.18
- Joomla joomla! 2.5.19
- Joomla joomla! 2.5.20
- Joomla joomla! 2.5.21
- Joomla joomla! 2.5.22
- Joomla joomla! 2.5.23
- Joomla joomla! 2.5.24
- Joomla joomla! 2.5.25
- Joomla joomla! 2.5.4
- Joomla joomla! 2.5.5
- Joomla joomla! 2.5.6
- Joomla joomla! 2.5.7
- Joomla joomla! 2.5.8
- Joomla joomla! 2.5.9
- Joomla joomla! 3.0.0
- Joomla joomla! 3.0.1
- Joomla joomla! 3.0.2
- Joomla joomla! 3.0.3
- Joomla joomla! 3.0.4
- Joomla joomla! 3.1.0
- Joomla joomla! 3.1.1
- Joomla joomla! 3.1.2
- Joomla joomla! 3.1.3
- Joomla joomla! 3.1.4
- Joomla joomla! 3.1.5
- Joomla joomla! 3.1.6
- Joomla joomla! 3.2.0
- Joomla joomla! 3.2.1
- Joomla joomla! 3.2.2
- Joomla joomla! 3.2.3
- Joomla joomla! 3.2.4
- Joomla joomla! 3.2.5
- Joomla joomla! 3.3.0
- Joomla joomla! 3.3.1
- Joomla joomla! 3.3.2
- Joomla joomla! 3.3.3
- Joomla joomla! 3.3.4
References
- CVE: CVE-2014-7229
- CVE: CVE-2014-7228
- URL: http://developer.joomla.org/security/595-20140903-core-remote-file-inclusion.html
- URL: https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html
- URL: http://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228/