An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion.

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities :

 - Local file inclusion with PHP 5.3 affects Joomla 2.5.0 through 3.8.8

 - XSS vulnerability in language switcher module affects Joomla 1.6.0 through 3.8.8

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.8.9. It is, therefore, affected by a file inclusion vulnerability.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
98517	Joomla! 1.6.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98516	Joomla! 1.7.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98515	Joomla! 2.5.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98514	Joomla! 3.0.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98513	Joomla! 3.1.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98512	Joomla! 3.2.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98511	Joomla! 3.3.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98510	Joomla! 3.4.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98509	Joomla! 3.5.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98508	Joomla! 3.6.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98507	Joomla! 3.7.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98506	Joomla! 3.8.x < 3.8.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
111063	Joomla! < 3.8.9 Local File Inclusion with PHP 5.3	Nessus	CGI abuses	high

Detections

Analytics

CVE-2018-12712

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high