Comments on: Howto fix Joomla 1.5 hacking (token admin password reset exploit)

By: Glenn

Glenn — Wed, 21 Apr 2010 14:38:05 +0000

Small correction ; the correct code should be :

$token = mysql_real_escape_string($token);
if(strlen($token) != 32) {
$this->setError(JText::_(‘INVALID_TOKEN’));
return false;
}

By: Glenn

Glenn — Wed, 21 Apr 2010 14:21:53 +0000

Figure this : the token ‘——–(…) would be 32 chars long .. since — is the starter for a comment in MySQL, that is ignored. Thus strlen($token) returns 32, while it is still “seen” in the query as ‘ .

Solution :

$token = mysql_real_escape($token);
if(strlen($token) != 32) {
$this->setError(JText::_(‘INVALID_TOKEN’));
return false;
}

By: Imran

Imran — Wed, 21 Oct 2009 16:47:20 +0000

I had this problem, I upgraded to 1.5.6 but after 2 days it happened again. I checked reset.php your suggested code is already there. Seems its not workig or hackers have bypassed this too. ANy idea?

By: jim

jim — Fri, 16 Oct 2009 01:26:20 +0000

this is addressed in the latest version of jomoola and yet they are still able to reset and hack the site

By: aj

aj — Wed, 22 Jul 2009 07:34:48 +0000

wow great content…I will do this…Thanks