CVE-2016-9836
CriticalSummary
The file scanning mechanism JFilterInput::isFileSafe() in Joomla! CMS before version 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, allowing users to upload and execute files with .php6, .php7, .phtml, and .phpt extensions. Additionally, JHelperMedia::canUpload() did not blacklist these file extensions as uploadable file types.
Risk Assessment
Exploitation of this vulnerability may lead to remote code execution on the server, posing a serious threat to the application's security and user data. Organizations may be exposed to attacks that could result in data loss or system takeover.
Recommendation
It is recommended to update Joomla! CMS to version 3.6.5 or later to mitigate this vulnerability. Additionally, implementing further security measures, such as scanning uploaded files for dangerous extensions, is advisable.
Original NVD description (English source)
The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the `.php6`, `.php7`, `.phtml`, and `.phpt` extensions. Additionally, JHelperMedia::canUpload() did not blacklist these file extensions as uploadable file types.