Vulnerability record · CVE-2015-8562 · published 16 December 2015
CVE-2015-8562: Joomla core unauthenticated PHP object injection via User-Agent header
Joomla · Joomla\!
Joomla 1.5.x, 2.x and 3.x before 3.4.6 fail to properly validate input, allowing PHP object injection through the HTTP User-Agent header that leads to arbitrary PHP code execution. The flaw was exploited in the wild in December 2015, and public exploit code and a Metasploit module exist, making it a practical remote compromise path for unpatched sites.
Description
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with in-the-wild exploitation and very high EPSS, though the CVE is not in CISA KEV and the affected versions are legacy.
What it is
Joomla 1.5.x, 2.x and 3.x before 3.4.6 fail to properly validate input, allowing PHP object injection through the HTTP User-Agent header that leads to arbitrary PHP code execution. The flaw was exploited in the wild in December 2015, and public exploit code and a Metasploit module exist, making it a practical remote compromise path for unpatched sites.
Impact
An unauthenticated remote attacker can execute arbitrary PHP code on the Joomla server, gaining control of the web application and potentially the underlying host.
Attack surface
Reachable over the network via a crafted HTTP request; the CVSS vector AV:N/AC:L/Au:N confirms no authentication and no user interaction are required. The injection point is the User-Agent header, so any exposed Joomla instance is directly reachable.
Exploitation
Exploited in the wild in December 2015 per the description, with multiple Exploit-tagged references and a Rapid7 Metasploit module; EPSS is very high (0.98283, 99.9th percentile), though the CVE is not listed in CISA KEV.
What to do
- Upgrade Joomla to 3.4.6 or later immediately; this is the vendor fix for the flaw.
- If immediate upgrade is not possible, apply the vendor's documented workaround or virtual patch at the WAF/reverse proxy layer.
- Remove or restrict public exposure of outdated Joomla installations until patched.
- Audit the server for signs of compromise and rotate credentials and secrets if exploitation is suspected.
Detection
- Inspect web server and proxy logs for anomalous or serialized payloads in the User-Agent header.
- Monitor for unexpected outbound connections or new files/processes spawned by the web server user.
- Alert on requests to Joomla endpoints from IPs with known exploit tooling signatures or repeated malformed User-Agent values.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-8562 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-8562), CISA KEV, FIRST EPSS (scores of 2026-09-22). This page is refreshed as NVD updates the record.
