Session Issue

Discussion regarding Joomla! 1.5 security issues.
Joomla! Vulnerable Extensions: http://feeds.joomla.org/JoomlaSecurityV ... Extensions

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
Locked
setzerdeleon
Joomla! Apprentice
Joomla! Apprentice
Posts: 12
Joined: Tue Oct 13, 2009 10:12 pm

Session Issue

Post by setzerdeleon » Mon Jan 20, 2014 3:26 am

This is a very strange issue and looks like a kind of attack related with session updates
When we load a webpage with Joomla we had this query on Joomla 1.5 (Pitiful we can't migrate to 2.5 yet...)
"UPDATE `ucweb_session` SET `time`='1389934602',`userid`='0'..... at the end the query saves this params com_mailto.links";a:6: and save some links (about 5 or 10 max) but from the last week we saw the transactional logs on BD and is HUGE!! we review the querys and we discover this:
The params com_mailto.links has many links ( A LOT of them more than 50 and this logs About 2GB logs on a couple of hours)
Before that the links on com_mailto.links were about 4 or 5... We disabled the component but the log still register that param and is HUGE. Any ideas what could cause this and how solve this?
Until I know nobody more has this issue

setzerdeleon
Joomla! Apprentice
Joomla! Apprentice
Posts: 12
Joined: Tue Oct 13, 2009 10:12 pm

Re: Session Issue

Post by setzerdeleon » Mon Jan 20, 2014 8:08 pm

Anyone could help with this:
This is the normal query:
UPDATE `xxxtable_session` SET `time`='1390222745',`userid`='0',`usertype`='',`username`='',`gid`='0',`guest`='1',`client_id`='0',`data`='__default|a:8{s:15:\"session.counter\";i:1;...)
when you see param "data" show a section with this... s:16:\"com_mailto.links\";a:5:{
and 5 or 6 links like this
s:40:\"ba3b5cb152ac65341051766c0968aad6fab014b8\";O:8:\"stdClass\":2:{s:4:\"link\";s:105:\"http://www.mywebsite.cl/es/seccion/noti ... 1390222518;}
s:40:\"ba3b5cb152ac65341051766c0968aad6fab014b8\";O:8:\"stdClass\":2:{s:4:\"link\";s:105:\"http://www.mywebsite.cl/es/seccion/noti ... 1390222518;}

Components mailto is disabled, anyone knows how this links are generated? who generate this?


Locked

Return to “Security in Joomla! 1.5”