Description

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.

INFO

Published Date :

Oct. 29, 2015, 8:59 p.m.

Last Modified :

Sept. 13, 2017, 1:29 a.m.

Remotely Exploitable :

Yes !

Impact Score :

6.4

Exploitability Score :

10.0
Public PoC/Exploit Available at Github

CVE-2015-7297 has a 23 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2015-7297 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Joomla joomla\!

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Joomla! Core SQL Injection

bugbounty-tools sql-injection cve-2015-7297 cve-2015-7297-scanner cve-2015-7297-sql-injection joomla-core-sql-injection joomlacore-sql-injection

Python

Updated: 4 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : May 26, 2024, 3:06 p.m. This repo has been linked 1 different CVEs too.

This project is made by Dhruv Gupta

Python Dockerfile CSS HTML JavaScript Shell

Updated: 3 months, 3 weeks ago
1 stars 0 fork 0 watcher
Born at : April 30, 2024, 2:33 p.m. This repo has been linked 3 different CVEs too.

None

Python Dockerfile CSS HTML JavaScript Shell

Updated: 3 months ago
0 stars 0 fork 0 watcher
Born at : Feb. 21, 2024, 1:39 p.m. This repo has been linked 3 different CVEs too.

A Python 3 library for exploring EPSS scores with Polars

epss polars python3 cve vulnerability-management

Makefile Python Shell

Updated: 3 months, 4 weeks ago
4 stars 0 fork 0 watcher
Born at : Dec. 21, 2023, 4:21 p.m. This repo has been linked 28 different CVEs too.

None

Python Dockerfile CSS HTML JavaScript Shell

Updated: 1 year, 9 months ago
0 stars 1 fork 1 watcher
Born at : Jan. 10, 2023, 3:14 a.m. This repo has been linked 3 different CVEs too.

None

Python Dockerfile CSS HTML JavaScript Shell

Updated: 1 year, 8 months ago
2 stars 2 fork 2 watcher
Born at : Sept. 5, 2021, 7:41 a.m. This repo has been linked 3 different CVEs too.

database of pocassist(漏洞库)

Updated: 1 year, 2 months ago
14 stars 21 fork 21 watcher
Born at : June 16, 2021, 11:36 a.m. This repo has been linked 61 different CVEs too.

database of pocassist(漏洞库)

pocassist vulnerability-scanners vulnerability-detection

Updated: 5 months, 4 weeks ago
81 stars 21 fork 21 watcher
Born at : June 16, 2021, 9:56 a.m. This repo has been linked 67 different CVEs too.

None

Python XSLT

Updated: 2 months, 3 weeks ago
17 stars 5 fork 5 watcher
Born at : May 22, 2021, 4:29 p.m. This repo has been linked 349 different CVEs too.

None

Python Dockerfile CSS HTML JavaScript Shell

Updated: 2 years, 11 months ago
3 stars 0 fork 0 watcher
Born at : Feb. 22, 2021, 11:32 a.m. This repo has been linked 3 different CVEs too.

Un semplice exploit che sfrutta CVE-2015-7297, CVE-2015-7857 and CVE-2015-7858 per elencare gli utenti con la psw del db

Python

Updated: 3 years, 5 months ago
0 stars 0 fork 0 watcher
Born at : Oct. 29, 2020, 12:35 a.m. This repo has been linked 3 different CVEs too.

essential templates for kenzer [DEPRECATED]

kenzer vulnerabilities kenzer-templates arpsyndicate

Python Shell Ruby

Updated: 2 months, 4 weeks ago
106 stars 32 fork 32 watcher
Born at : Sept. 18, 2020, 9:03 p.m. This repo has been linked 1653 different CVEs too.

None

Python Dockerfile Shell CSS HTML JavaScript

Updated: 2 months, 2 weeks ago
4 stars 1 fork 1 watcher
Born at : March 10, 2020, 1:39 a.m. This repo has been linked 3 different CVEs too.

None

Python Dockerfile Shell CSS HTML JavaScript

Updated: 2 years, 2 months ago
1 stars 0 fork 0 watcher
Born at : Jan. 22, 2020, 8:01 p.m. This repo has been linked 3 different CVEs too.

maltrail under V&R support, fork from https://github.com/stamparm/maltrail

Python Dockerfile Shell CSS HTML JavaScript

Updated: 9 months, 2 weeks ago
1 stars 0 fork 0 watcher
Born at : Jan. 7, 2020, 7:18 a.m. This repo has been linked 3 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2015-7297 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2015-7297 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Sep. 13, 2017

    Action Type Old Value New Value
    Added Reference https://www.exploit-db.com/exploits/38797/ [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 07, 2016

    Action Type Old Value New Value
    Added Reference http://www.rapid7.com/db/modules/auxiliary/gather/joomla_contenthistory_sqli [No Types Assigned]
    Added Reference http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html [No Types Assigned]
    Added Reference http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html [No Types Assigned]
    Added Reference http://www.rapid7.com/db/modules/exploit/unix/webapp/joomla_contenthistory_sqli_rce [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2016

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/77295 [No Types Assigned]
  • Modified Analysis by [email protected]

    Oct. 30, 2015

    Action Type Old Value New Value
    Added CPE Configuration Configuration 1 OR *cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.2.3:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.2.4:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.3.0:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.3.1:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.3.2:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.3.3:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.3.4:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.4.0:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.4.1:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.4.2:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.4.3:*:*:*:*:*:*:* *cpe:2.3:a:joomla:joomla\!:3.4.4:*:*:*:*:*:*:*
    Added CVSS V2 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
    Changed Reference Type https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/ No Types Assigned https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/ Exploit
    Added CWE CWE-89
  • Initial Analysis by [email protected]

    Oct. 30, 2015

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2015-7297 is associated with the following CWEs:

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

97.44 }} -0.08%

score

0.99962

percentile

CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability