Milia Treatment Cream Uk

Vulnerability Joomla versions 1.5.x and possible solutions







On August 12, 2008
Support Officer at the famous CMS Joomla

announced the discovery of a security hole present in all versions 1.5.x

. The vulnerability allows an attacker to edit

Administrator account password using the password recovery feature made available by the component

"com_user". OFFICIAL ANNOUNCEMENT (English version)

OFFICIAL ANNOUNCEMENT (ITALIAN VERSION) If successfully exploited, This vulnerability allows administrators to log on as the admin panel of Joomla, and through this, allows you to edit pages ( defacing

), read the contents of the file, change the Database, etc. In particular, after performing this change the password, you can view the contents of the file

"configuration.php" and, therefore, seize the data FTP and MySQL that are presented in clear in the same file. There are two methods provided order to fix the problem of the vulnerability.

1. The first, highly recommended by Aruba, is in ' constantly maintain and update updated version of the application , meanwhile, has come to

version 1.5.7 as additional vulnerabilities have been discovered.

follow the links from which to download the updated version:

Package Official English

Package Official Italian

2. The second method in order to fix the problem consists in '

manually edit the file component

"com_user" tested at the problem. To do this you must open in editing the file:

/ components / com_user / models / reset.php

and add the following code to

line 113. If the line numbers do not match, the following code should be inserted just after the line "global $ mainframe;"

if (strlen ($ token)! = 32) {

$ this-> setError (JText ::_(' INVALID_TOKEN '));

return false;

} In case you have undergone this kind of hacking is possible that after the update manual correction or the "defacing" It is still present. In order to solve this problem please feel free to delete all the templates used, and thereafter to make a new upload of the same.