{"uuid": "c34575e5-7779-49eb-8f04-5a6f947af25a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23752", "type": "exploited", "source": "https://t.me/hacking_Attack/95887", "content": "hacking: security in practice\nJoomla! CVE-2023-23752 to Code Execution\n\nOn February 16, 2023, Joomla! published a security advisory for CVE-2023-23752. The advisory describes an \u201cimproper access check\u201d affecting Joomla! 4.0.0 through 4.2.7. The following day, a chinese-language blog shared the technical details of the vulnerability. The blog describes an authentication bypass that allows an attacker to leak privileged information.\n\nThe blog\u2019s disclosure was followed by a stream of exploits hitting GitHub, and multiple indicators of exploitation in the wild. The public exploits focus on leaking the victim\u2019s MySQL database credentials \u2013 an unexciting prospect (we thought), because exposing the database to the internet is a dangerous misconfiguration. Nonetheless, attackers seemed interested in the vulnerability, so we sought to find out why.\n\nJoomla! Versions in the Wild\n\nThe importance of a vulnerability is often linked to the number of affected internet-facing systems. A couple Shodan queries find approximately 50,000 internet-facing Joomla! Instances. Censys, with virtual hosts included, puts that number closer to 1.3 million installations. We only have access to the Shodan data though, so we continue with that for the remainder of this writeup.\n\nA Joomla! installation\u2019s version can be remotely extracted without authentication by querying one of a few different endpoints. Joomla! version 4 exposes version information in the /language/en-GB/langmetadata.xml\nendpoint. Additionally, most, if not all, Joomla! Instances expose their version in the /administrator/manifests/files/joomla.xml\nendpoint (retrievable without authentication, despite the pathname). We scanned the IP addresses indexed by Shodan and found that Joomla! 4 is not very popular. Only about 14% of responding Joomla! instances used version 4, the only version affected by CVE-2023-23752.\n\n\u200b\n\nhttps://vulncheck.com/blog/joomla-for-rce\n\nsubmitted by /u/0ryX_Error404 \n[link] [comments]", "creation_timestamp": "2026-09-04T19:00:05.083293Z"}