CVE-2013-1453: joomla joomla\!
Vulnerability summary
CVE-2013-1453 is a high (CVSS 7.5) vulnerability in joomla joomla\!. EPSS estimates a 3.15% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 13-02-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information, delete arbitrary directories, conduct SQL injection attacks, and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowed attackers to obtain sensitive information, but later analysis demonstrated that other attacks exist.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.15%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.15% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (karmainsecurity.com)
Maturity: unknown
Joomla! 3.0.2 - 'highlight.php' PHP Object Injection
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Joomla1 product
- joomla\!EOL2.5.0 | 2.5.1 | 2.5.2 | 2.5.3 | 2.5.4 | 2.5.5 | 2.5.6 | 2.5.7 | 2.5.8 | 3.0.0 | 3.0.1 | 3.0.2
1 vendor · 1 product
References
4 links- developer.joomla.org/security/news/548-20130201-core-information-disclosure.htmlX Refsource CONFIRMVendor Advisory
- karmainsecurity.com/analysis-of-the-joomla-php-object-injection-vulnerabilityX Refsource MISCExploit
- karmainsecurity.com/KIS-2013-03X Refsource MISC