Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [joomla]

Joomla is a free and open source content management system (CMS) for publishing content on the World Wide Web.

0
votes
0answers
28 views

how to substitute DisconnectHandlers of Joomla?

I am having problems with the exploit **Joomla! 1.0 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution CVE : CVE-2015-8562 , CVE-2015-8566** It doesn't work on Joomla ...
0
votes
1answer
44 views

Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]

I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization. TEST MACHINE xammp 1.7.3 for ...
0
votes
0answers
24 views

How various CMS encrypt password across past releases

I am interesting in knowing how Drupal, Wordpress and Joomla have managed password encryption (hashing algorithims) across their various releases, from the very first to the latest. Thanks.
0
votes
2answers
82 views

PHP Code Injection vulnerability exists even after recommended hardening

Using Burp to intercept traffic and inject code we have identified remote code execution vulnerability in a website. After entering data in input fields on the form and clicking submit the traffic ...
0
votes
2answers
1k views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
1
vote
0answers
94 views

How to forbid hackers on a Joomla website? [closed]

My Joomla website was the victim of a hacker attack recently. Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ...
0
votes
1answer
59 views

Does a 32 character random url count as protection? (UUID) [closed]

We are using Ohanah, an event management extension for Joomla. It had a lot of bugs, but we fixed them. But there is a very big issue! You can access: E-mail, Name, Telephone, directly in the front ...
0
votes
1answer
269 views

Execution of PHP function's through HTTP GET request by hacker [duplicate]

We are continuously receiving following requests on our apache server from the hackers ?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0); @set_magic_quotes_runtime(0);echo%20'-%3E%7C';...
3
votes
3answers
445 views

Will PHP malware from my hacked website be able to infect my computer locally if downloaded?

I have site that is hacked and flagged by Google for having malware: Some pages on this website send visitors to the following dangerous websites: freshmodel.pw. I made a backup of everything ...
2
votes
0answers
885 views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
8
votes
5answers
5k views

How can a PHP file be added over and over to my hacked site?

I'm on a shared hosting plan (I know, I know) on GoDaddy and all the files in it have been hacked. There are multiple sites in the plan, each of them has a folder. The folders and sub-folders of each ...
2
votes
2answers
252 views

How to secure store sessions values in webapps?

EDIT: I changed the title of this post from "How to manage sessions in webapps?" to "How to secure store sessions values in webapps?" as it might have been misleading In the recent months I happened ...
1
vote
1answer
674 views

Why does error-based SQL injection works only with certan fields?

I'm currently investigating the latest vulnerability affecting Joomla CMS. You can find here a description of the vulnerability, however my question is merely on error-based SQL injections and is ...
2
votes
2answers
270 views

Log shows many hits to non existing content - hacking?

I have a website with Joomla and 404shSEF installed. The component logs all 404 requests and the log is really interesting. The site is getting requests on components and also a file called this: "...
2
votes
2answers
702 views

Hack: anymonous URL on my Joomla Website[Resolve] [closed]

My website has been hacked again. There are many foreign URLs such as here. I've checked the database and there is nothing strange in my database. Does anyone know what kind of hack attack is like ...
0
votes
1answer
446 views

Joomla Linux Permissions

I installed Joomla 3 to /var/www/html directory in Cent OS 6 server. Currently /var/www/html is owned by apache:apache. What is the recommended permissions for Joomla installation on Linux in ...
1
vote
0answers
1k views

Akamai or Incapsula (or other) for CDN with DDoS Protection? [closed]

One of our clients is launching a new site and I've been tasked with making a short overview of the advantages/disadvantages of Akamai, Incapsula or other CDN providers who are strong with DDoS ...
0
votes
2answers
629 views

NGO Joomla! site: Infected with malware? JavaScript injection?

Please help us with this NGO site running Joomla! 1.5. They can't pay a security professional right now, so maybe you guys can help isolate the problem? If you go to http://casatrespatios.org you ...
1
vote
1answer
575 views

Installing Joomla with nobody:nobody user/group (CentOS/cPanel)

If you are installing Joomla via cPanel's File Manager to your mywebsite.com (user mywebsite) account, you will upload the package to your server and extract the archive. All files will have the user ...
-1
votes
2answers
218 views

My VPS has been shut down now again for the second time for TOS violations, and I really need some help. [closed]

My VPS has been shut down now again for the second time for TOS violations (email spam), and I really need some help. I have been battling with my server being attacked for over a year now. Most of my ...
1
vote
5answers
2k views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. eval((base64_decode("...
1
vote
1answer
5k views

my site with joomla 1.5.14 got defaced and I'd like to know how he did it and stop it

I am supposed to manage the content of a site and it got defaced. The site is hosted on a Linux server running Apache. Apache version: 2.2.13 Linux version is Debian 4.0(I think I don't really have ...
0
votes
3answers
1k views

Viewing the configuration.php

My understanding is that you should never host your configuration.php file within the public_html directory (I am specifically referring to Joomla, but I imagine this is a cross-platform scenario). ...