CVE-2015-7858: Joomla! core SQL injection allows arbitrary SQL execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote, unauthenticated SQL injection in a widely deployed CMS with public exploit code and very high EPSS, though not in KEV.

What it is

Joomla! 3.2 before 3.4.4 contains a SQL injection flaw distinct from CVE-2015-7297, allowing remote attackers to run arbitrary SQL commands through unspecified vectors. Because Joomla! is widely deployed and the flaw is remotely reachable without authentication, it is a serious risk to unpatched sites.

Impact

An attacker can read or modify database contents and, per public exploit write-ups, chain the injection to full administrative access and remote code execution.

Attack surface

Reached over the network via HTTP against the Joomla! core; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The exact vulnerable parameter is not specified in the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.85557, 99.7th percentile) and public exploit code exists (Exploit-DB 38797, Rapid7 module, Trustwave blog tagged Exploit), indicating active exploitation is likely.

What to do

• Upgrade Joomla! to 3.4.4 or later immediately; this is the vendor fix.
• If immediate upgrade is impossible, restrict or block access to the affected Joomla! endpoints at the WAF or reverse proxy.
• Audit the Joomla! database and admin accounts for unauthorized changes or added administrator users.
• Rotate Joomla! administrator credentials and any secrets stored in the site configuration after patching.
• Monitor Joomla! release notes and apply future core security updates promptly.

Detection

• Review web server logs for SQL injection patterns (UNION, SLEEP, BENCHMARK, quote-heavy payloads) against Joomla! paths.
• Alert on unexpected creation of Joomla! administrator accounts or privilege changes in the users table.
• Monitor for outbound connections or file writes consistent with post-exploitation RCE following a SQL injection.
• Correlate requests to Joomla! content history or com_content endpoints with anomalous database query volume.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.