The document discusses vulnerabilities found in the popular content management system Joomla. It notes that over 30 million downloads of Joomla have occurred to date. It then discusses specific vulnerabilities the author has discovered in Joomla, including an old version of the JCE ImageManager add-on that is included in some template bundles. The document stresses the importance of updating, managing, and maintaining applications to address vulnerabilities and protect sites.

1. And consequences
JOOMLA VULNERABILITIES
- Abhibandu Kafle

2. Bachelors in computer engineering final year student
Been acknowleged by adf.ly and apple.com for responsible
disclosure
Of vulnerabilities
Founder of Nep Security community
WHO I AM?

3. WHAT I HAVE BEEN DOING ?

4. THE SCENERIO

5. -most popular CMS solutions for community sites in the world
-boasts over 30m downloads to date.
-powers noteworthy sites as Cloud.com, Linux.com
JOOMLA : INTRODUCTION

6. VULNERABILITIES
DISCOVERED/ADDRESSED
0
20
40
60
80
100
120
140
year 2010 year 2011 year 2012
patched now
not been given a fix
http://docs.joomla.org
/Vulnerable_Extension
s_List

7. Problem is that an old version of one of the JCE
addons called ImageManager
Templates providers include the JCE editor together with
ImageManager as part of their template bundle installations
Affrected versions = 2.0.10 and below
LIVE DEMO OF JCE

8. All of us knew, we needed to update , manage and maintain the application.
The demo explained , why ?
Realizing the scenerio and being responsible
WHAT TO LEARN ?