Hot answers tagged


That is the background noise of the Internet: a bot scanning for commonly used admin interfaces, potentially vulnerable pages and software and well-known PHP backdoors. In itself, this doesn't gives you any indication about the status of your server: it just tells you that a bot scanned it for common PHP entry point. It doesn't indicate if any was found, if ...


JRoute is the module tasked with dealing with internal urls. The evil code is hooking there to make such urls show their spam page. You could see what they changed by comparing the files with the official ones from Joomla. In the end, you should replace the compromised Joomla php files with the original ones.


Here are which requests work using this injection and which doesn't, associated to their column types: What works: Using MySQL internal functions like users(), database(), etc. Using system variables like @@version, etc. Accessing short sized column contents like these ones all from the *_users table: *id (int(11)), email (varchar(100)), password ...

Only top voted, non community-wiki answers of a minimum length are eligible