Skip to content
OpenAdvisories
Unscored Public exploit CVE-2013-1453 EUVD-2013-1489GHSA-397m-73pj-3xm8

plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP…

Published Feb 13, 2013 · Updated Aug 6, 2024 · Assigned by mitre

Description

plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information, delete arbitrary directories, conduct SQL injection attacks, and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowed attackers to obtain sensitive information, but later analysis demonstrated that other attacks exist.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 1 repository

  • stupazz/joomla-cve-2013-1453 ★ 0 · Nov 11, 2026

    CVE-2013-1453: Joomla 2.5.x PHP Object Injection — Complete Gadget Chain Analysis with Docker Lab and PoC Exploits

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References