Login or create new account.

By registering on joomprod.com, you will have immediate access to all our free products and to the public side of our support forum.

Enjoy our subscriptions.

Each of our subscriptions allow you to enjoy the private side of the support forum and all the update of our products for a period ranging from 3 months to 1 year.

Payment And immediate download.

After subscribing to one of our subscription, the products are immediately downloadable.

Accueil / forum / Public Forum / Main Forum / ADSmanager Exploit: my site under attac

Support Availability Because we must sleep sometimes

Working days: Monday to Friday.
Reply time: Depending on the complexity of your support issue it's usually between a few hours to 48 hours.

Support is only guaranteed to paid subscribers

AdsManager - End of life

It is with great regrets that we have chosen to end the developpement of Adsmanager and its other associated components.

AdsManager is born 10 years ago and, as of today, the number of new subscriptions and downloads have fallen and we cannot maintain the component anymore.

All active subscribers will be able to continue enjoying support until the end of their subscription.

The components will be free and no support will be provided anymore for the other users.

Notice

The forum is in read only mode.

× OLD Forum post could be checked here : forum.joomprod.com

ADSmanager Exploit: my site under attac

azulai
Topic Author
Offline
User

11 years 3 months ago #12529 by azulai

ADSmanager Exploit: my site under attac was created by azulai

Hi there
I discovered that my site is under attac, and searching on google i find there is an exsploit on adsmanager.
www.exploit4arab.net/exploits/1621
Any one know how to fixed?

thanks for help

loic
Offline
Gold

11 years 3 months ago #12564 by loic

Replied by loic on topic ADSmanager Exploit: my site under attac

Hello,

This issue was solved a year ago and can happen only between the version 2.6 and 2.9.13 not included.

An article was written on this website regarding this issue (www.joomprod.com/news/273-security-issue...-on-old-version.html) and we also sent a newsletter.

If you are using one of the versions with this issue, just update your adsmanager to 2.9.13.

Best regards.

scilla
Offline
User

11 years 3 months ago - 11 years 3 months ago #12656 by scilla

Replied by scilla on topic ADSmanager Exploit: my site under attac

Unfortunately, this hack is also available for the last version of Ads Manager 3.1.1. Check here: www.exploit4arab.net/exploits/1621 it is from 07.07.2015. I am using the last available version 3.1.1 and my hosting provider alarmed me about this and that is why the picture upload does not work.

Last edit: 11 years 3 months ago by scilla.

tompap
Offline
Gold

11 years 3 months ago #12659 by tompap

Replied by tompap on topic ADSmanager Exploit: my site under attac

Hello,
3.1.1 was released on 13th July. so the link you sent is not applicable in any case to this version.

Also the bug exploited into this link, it's only applicable with version under 2.9.13

in 3.1.1 released on Monday, we add another fix to improve security.

In fact the fix in 2.9.13 is sufficient but an user can upload some php code in a file that is not executed (so no security risk)
but if another bug in another component exists that can rename this file to php, then the code could be executed.

So in 3.1.1 it's just to have max security, but the fix in 2.9.13 is sufficient.

Also, I wiill suggest to anyone building a website with Joomla to update .htaccess to limit the execution to index.php so like this you have the maximum security and even if you a component with a bug to upload php file, the php file will not be executable.
This modification on .htaccess is one of the security step with a component like admintools.
I will recommand admintools for all joomla websites.

The following user(s) said Thank You: scilla

catalinads
Offline
Gold

11 years 3 months ago #12663 by catalinads

Replied by catalinads on topic ADSmanager Exploit: my site under attac

This functionk works only with admin pro version ?

tompap
Offline
Gold

11 years 3 months ago #12664 by tompap

Replied by tompap on topic ADSmanager Exploit: my site under attac

If think Yes only with PRO, because you need the .htaccess maker

after that if you know a little about .htaccess you can write yourself the access limit to index.php

Moderators: perry

Time to create page: 0.052 seconds