Skip to main content

Posts

Showing posts from August, 2008

Critical Security at Joomla 1.5.X before 1.5.6 Version

Two day ago, Our Official website has defaced by some one, They change layout our official website with another picture. i have investigate, the hole is from Joomla software where our office use to built website. to recover that's hole we must edited joomla source code at : File : /components/com_user/models/reset.php Line: 111-130 {1} - Replace ' with empty char {3} - If you enter ' in token field then query will be looks like : "SELECT id FROM jos_users WHERE block = 0 AND activation = '' " that's smart solution, than upgrade to higher joomla version.