CVE-2013-1453 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 3.1% (pctl 88)
Patch early
A public exploit exists.
Description
plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information, delete arbitrary directories, conduct SQL injection attacks, and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowed attackers to obtain sensitive information, but later analysis demonstrated that other attacks exist.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 3.15% — more likely to be exploited than 88% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2013-02-13 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| joomla | joomla\! |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Joomla! 3.0.2 - 'highlight.php' PHP Object Injection | 2013-02-27 |
References
- http://developer.joomla.org/security/news/548-20130201-core-information-disclosure.html
- http://karmainsecurity.com/KIS-2013-03
- http://karmainsecurity.com/analysis-of-the-joomla-php-object-injection-vulnerability
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81925
- http://developer.joomla.org/security/news/548-20130201-core-information-disclosure.html
- http://karmainsecurity.com/KIS-2013-03
- http://karmainsecurity.com/analysis-of-the-joomla-php-object-injection-vulnerability
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81925
→ the Explorer · watch your stack · NVD