One of my 1.0.10 sites hacked, extcalendar to blame, found perl script

[marcopolo]

Hi there,

One of my sites got hacked yesterday, turned out to be an SQL injection in the extcalendar component.  They managed to:

- put a perl script in the com_extcalendar directory and run it (a type of udp flood attack)
- overwrite my configuration.php script
- leave a tag html file in the components directory.
- overwrite the extcalendar.class.php file and add an include line.
- overwrite the extcalendar.php file

If any of the Joomla devel team are interested I can of course provide the scripts. PM me.
PLEASE NOTE: I will only supply script to Joomla Development team members, so no PM's from other people

For some peculiar reason, I can now not change the directory permissions on the com_extcalendar directory in order to remove write access, my FTP client reports a permission denied error.  Perhaps they have changed unix group too.. will investigate.

[Elpie]

It is likely that the directory has had permissions changed to server permissions so you may need your host to chown ownership back to you.

ExtCalendar has had a security release that addresses a number of vulnerabilities in the version you were running.
See here: http://forum.joomla.org/index.php/topic ... #msg402249

[marcopolo]

Wonderful news, thanks for your help.

[vscribe]

The Perl script attack was reported about a week ago (this one that got you) by SANS. It is posted over there on their site. (not the code, but the breakdown).