Massive hacking campaign on Joomla sites via recently patched flaws
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2016-8869+1 related CVE | The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain… | 9.8 group max | 97% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 81.196.107.174 | addresses used by the attackers. 82.76.195.141 82.77.15.204 81.196.107.174 Sucuri also detected another IP address from Latvia used to |
| ipv4 | 82.76.195.141 | a sites. Below the three IPaddresses used by the attackers. 82.76.195.141 82.77.15.204 81.196.107.174 Sucuri also detected another IP |
| ipv4 | 82.77.15.204 | the three IPaddresses used by the attackers. 82.76.195.141 82.77.15.204 81.196.107.174 Sucuri also detected another IP address from |
From the original article
2 min read at securityaffairs.comExperts from the firm Sucuri observed a spike in the number of attacks in less than 24 hours after Joomla released patches for two critical flaws. On October 25, Joomla released the version 3. 6.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.