CVE-2015-7857: Joomla com_contenthistory SQL injection in getListQuery

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote SQL injection with public exploit code, a Metasploit module and a documented path to full administrative access and RCE.

What it is

Joomla! 3.2 before 3.4.5 contains a SQL injection in the getListQuery function of administrator/components/com_contenthistory/models/history.php. The list[select] parameter passed to index.php is not properly sanitized, letting remote attackers inject arbitrary SQL. Because the vulnerable code sits in an administrator component, successful exploitation can lead to full administrative access.

Impact

An attacker can execute arbitrary SQL commands against the Joomla database, enabling data theft, credential extraction and, per public exploit write-ups, escalation to remote code execution and full administrative control of the site.

Attack surface

Reached remotely over HTTP through index.php with a crafted list[select] parameter; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.94472, 99.8th percentile) and multiple public references, including Exploit-DB 38797, a Rapid7 Metasploit module and a Trustwave exploit write-up, describe working exploits.

What to do

• Upgrade Joomla! to 3.4.5 or later immediately; this is the only complete fix.
• If immediate upgrade is impossible, restrict access to /administrator via IP allowlisting or a WAF rule blocking the list[select] parameter.
• Apply virtual patching at the WAF for SQL injection patterns targeting com_contenthistory and index.php.
• Rotate Joomla administrator and database credentials after any suspected exposure.
• Audit the site for webshells and unauthorized admin accounts, since public exploits chain this SQLi to RCE.

Detection

• Search web server logs for requests to index.php containing list[select] or com_contenthistory parameters.
• Monitor database logs for anomalous SELECT/UNION or stacked queries originating from the web application account.
• Alert on new or modified files under Joomla web directories and on unexpected administrator account creation.
• Review outbound traffic from the Joomla host for signs of post-exploitation tooling or data exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.