Joomla: SQL injection in com_contenthistory (CVE-2015-7857) fixed in 3.4.5, reported exploited
Published 07/11/2026 19:22
Timeline
4 events over 4 d 18 h
- 03/11/2026First report+4 d 17 h
- 07/11/2026 18:46Corroborateddeveloper.joomla.org+0 min
- 07/11/2026 18:46Confirmeddeveloper.joomla.org+35 min
- 07/11/2026 19:22Published on WatchtowerPro CISO
In short
Joomla! CMS 3.2.0 through 3.4.4 has a SQL injection flaw (CVE-2015-7857) in the core content history component. A remote attacker can send a crafted list[select] parameter to index.php and run their own SQL commands. The Joomla project confirms the flaw in its advisory 20151001 (which also covers CVE-2015-7297 and CVE-2015-7858) and says to upgrade to 3.4.5, released on 22/10/2015. Public exploit code exists.
Shodan recognises at least 24,655 internet-facing Joomla servers worldwide, 10,594 of them in the EU (11/11/2026); the real number is likely higher, and how many run an affected version is not yet known. GreyNoise reports a public exploit for CVE-2015-7857 (09/11/2026).
How bad is it
High. An attacker who can reach a vulnerable Joomla website can read or alter its database and, with public exploits, may take over the site, without logging in.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
No CVSS score published yet
CVE-2015-7857: no score published yet. A missing score is never read as 0.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Joomla! CMS 3.2.0 through 3.4.4 (vendor advisory 20151001, which covers CVE-2015-7297, CVE-2015-7857 and CVE-2015-7858)
- A remote attacker sends a crafted list[select] parameter to index.php; the GitHub advisory text matches this description
Fixed in
- 3.4 branch: 3.4.5 (released 22/10/2015)
What to do now
- Upgrade Joomla to version 3.4.5 or later. Sites on 3.2.0 through 3.4.4 are affected.
- The vendor names no interim measure, so there is no setting that makes an unpatched site safe. Update as the first priority.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 3 open questions, followed up as sources answer and all 3 sources with their dates. And technology matching: which of your systems run Joomla, at which version, fixed or not - and what each one needs.
Main sources
[20151001] - Core - SQL Injection Vendor · Known exploited (VulnCheck KEV): Joomla! Joomla! - Joomla! Joomla! Improper Neutralization of Special Elements used in an SQL Command Research · NVD - CVE-2015-7857 Research
Data: Shodan - Joomla (estimate, 11/11/2026) · GreyNoise - CVE-2015-7857 (estimate, 09/11/2026)