Recent Joomla! Compromise Might Affect You

Category : Website Security
Posted on : Sep 17, 2012
Views : 3,072
By : Radcliff S.

We are noticing a string of Joomla! compromises, and we wanted to share some details for those running the Content Management System (CMS). This current exploit is affecting the following versions of Joomla :

1.6.x
1.7.x
2.5.0-2.5.2
2.5.4
all earlier 2.5.x versions

The compromise begins with the attacker registering a user, and then escalating that user’s privileges to an administration level. In every case, we noticed the attackers add a user with a Gmail™ address beginning with xxxtxxx and the user name of alexaalexa.

Once the attackers have their user on the account, they typically come back a few days later and edit the error.php file to create a script that allows people to upload content anonymously. A few days after the creation of the file upload script, the attackers come back again and uploads the following file s:

rp.php
indx.php
stph.php

This attack is extremely malicious, and the stph.php file performs other aggressive attacks against other networks. To see if your site is affected, run the following query :

SELECT u.username AS username, u.email AS email, g.group_id AS group_id

FROM jos_users u, jos_user_usergroup_map g

WHERE u.email LIKE ‘xxxtxxx%’

AND u.id = g.user_id

If the email matches xxxtxxx, the user name matches alexaalexa, and the group_id is either a 7 or 8, your account is compromised. Group_id 7 is associated with the Administrator group, and group_id 8 is associated with the Super Administrator group. As a general rule, users do not have these permissions.

If affected, we recommend taking the following actions:
Remove the uploaded files, and then restore the error.php file to its original content.
Remove any users with the group_id of 7 or 8.
Update Joomla to the latest version.
Update all themes, plugins, and extensions to their latest versions.

Previous Post
How to Handle the Google Attack Page

Next Post
Website Maintenance Checklist the Next Phase of Website Development.

Archive Calendar

Sat	Sun	Mon	Tue	Wed	Thu	Fri
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31

Born in 2004 ... Trusted By Clients n' Experts

They never made me feel silly for asking questions. Help me understand how to attract more people and improve my search engine ranking.

Took advantage of Hostseo's superb tech support and I must say, it is a very perfect one. It is very fast, servers reliability is incredible.

We're operating a worldwide network of servers with high quality standards requirements, we’ve choose hostseo to be our perfect partner.

It’s very comfortable to know I can rely about all technical issues on Hostseo and mostly that my website and emails are safe and secured here.

With hostseo as a hosting partner we are more flexible and save money due to the better packages with great pricing, free SEO n' free SSL too!

HostSEO Blog