Joomla versions 1.5.x through 3.4.5 object injection exploit that allows for code execution and more. Written in golang.
1134e88fe3a65c32fd5110807c6df065cc7bbbc72d79341eb6c13b16011fca94
Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5.0 to 3.4.5. By storing user supplied headers in the databases session table it's possible to truncate the input by sending an UTF-8 character. The custom created payload is then executed once the session is read from the database. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. In later versions the deserialisation of invalid session data stops on the first error and the exploit will not work. The PHP Patch was included in Ubuntu versions 5.5.9+dfsg-1ubuntu4.13 and 5.3.10-1ubuntu3.20 and in Debian in version 5.4.45-0+deb7u1.
5a665a27f3d12ff63349cd4ca300cdf8e60e5919f5df2fde458870a5b8bac108