CVE-2010-1433: 
Joomla vulnerability analysis and mitigation

Joomla! Core versions 1.5.x (from 1.5.0 through 1.5.15) is affected by an arbitrary file upload vulnerability. The vulnerability exists because the migration script in the Joomla! installer fails to properly verify user-supplied input and does not check the file type being uploaded (Vendor Advisory, Acunetix Advisory).

The vulnerability is tracked as CVE-2010-1433 and has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue specifically resides in the migration script of the Joomla! installer component. If the installation application is present, an attacker could exploit this vulnerability to upload malicious files to the server (Vendor Advisory).

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access, privilege escalation, and other potential attacks (Acunetix Advisory).

The vulnerability can be exploited if the installation application is present on the server. No authentication is required to exploit this vulnerability, making it particularly dangerous (Vendor Advisory).

The recommended solution is to upgrade to Joomla! version 1.5.16 or later. The vulnerability was fixed in version 1.5.16, released on April 23, 2010 (Vendor Advisory, Acunetix Advisory).