Hello,

fasterjoomla writing here on behalf of my good client William, who got the site hacked repeatedly with a remote php upload to the root, most often the Zoot attack.

After securing and writing some prevention code we decided to log posts and figure out the weak component. We have already a migration to J3.3 in progress so this hopefully will be already solved with the current version, which we haven't rolled out on the old site, still running 3.1.0.

The bots got in with a post to the azrul_ajax controller, function photos,ajaxUploadAvatar, which runs the posted code unsuspectingly. I am attaching the full post with the attack. Please respond and let us know if the issue is fixed already or when you do fix it. The vulnerability is pretty serious, they could have done just about anything: luckily they were kind enough not to.

Thank you,

Riccardo (direct contact on fasterjoomla.com)

Hi, William.

Oh, we ware writing about this in February and instantly provided a patch: www.jomsocial.com/blog/hot-fix-3-1-0-4
Info about this was displayed on JomSocial dashboard...

Thank you