Currently, there is a high vulnerability risk for addon components to Mambo and Joomla due to our servers having register_globals set to ON in the global php.ini This is being exploited to run the following type of url string to upload malicious files onto an account:
is the component such as com_smf
is the file like smf.php
(these are just examples, many Mambo and Joomla addon components have this security hole), and where somesite.com
is any site where the hacker has his crummy file and somemaliciousfile.txt
is that file.
The manner to fix this issue is the following:
1. Create a php.ini on the account at /home/user/public_html (user here indicated your cPanel username). You can reach this location if you log into cPanel, click on File Manager, then click on the folder icon next to public_html folder. Inside public_html, simply click "Create File" link, then in the upper right, name the file php.ini. Check the file doesn't already exist in public_html. If it does exist, simply add the 2 lines in Step #2 to that file.
2. In the php.ini file put:
register_globals = Off
allow_url_fopen = Off
3. In public_html folder, open .htaccess file by clicking on the file's name in File Manager and selecting "Edit File" in the upper right hand corner list of links, then add this (change user
to your cPanel username in the /home/user/public_html path):
deny from all
4. In the exploited or exploitable file in question (/home/user/public_html/mambolocation/components/com_somecomponent/componentfile.php), add this:
defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.');
Put that at the top right after the opening php tag (<?php
These should ensure the component is not exploitable.
I hope this helps.Edit:
There are 2 very helpful threads on Joomla's forum about security for Joomla (Mambo would be able to benefit from the same discussion as these will also help to protect it more):http://forum.joomla.org/index.php/topic,75376.0.htmlhttp://forum.joomla.org/index.php/topic,76578.0.html