Security Hole in FlexiContent...

So we've been having a problem with a government site getting spyware files on it that basically is hosting phising sites.

We host with Rackspace (Cloud Sites) who has been working with us to trace how this is happening, so it's NOT a server issue.

We thought maybe it was a problem with the FTP Username/Password and again, that's not the issue after working on this with Rackspace on and off for 3 months.


So the access is /com_flexicontent/librairies/phpthumb where the files are put, which allows them access to just about anywhere on the site to upload these spyware/malware files. (how ever you want to call it)

First it was in these path, then they put files in the /cache directory and now this week they were creating them in /plugins/ and naming it Betterperview (a plugin for Joomla).


So my question is, what security holes are you aware of and how are people able to gain access to upload files/directories to a server? This is a very serious issue that I hope you guys are able to address.

Thank you for your attention! Attached is a screenshot of the extra files in this libraries directory.

[attachment=0:35p0761l]<!-- ia0 -->hacked-directory.jpg<!-- ia0 -->[/attachment:35p0761l]

the problem was solved.
use search or download svn-version what contain patched phpThumb library

a new version is comming with solved issue !

Any idea how soon it will be released?

I've just downloaded the most recent version from the svn - I'll just unzip it and upload the new files for /components/com_flexicontent/librairies/phpthumb

ok I just looked at that latest version and I see nothing different in the /components/com_flexicontent/librairies/phpthumb directory of files

code.google.com/p/flexicontent/downloads/list

so you looked in wrong place

code.google.com/p/flexicontent/ ... 2Fphpthumb