Admin Password Reset Vulnerability in Joomla 1.5

Written by barrie@compassdesigns.net

Tuesday, 12 August 2008

Its recently surfaced that there is a small hole in the password reset process for Joomla 1.5. Recently for me as this site was hacked late this afternoon and I spent an amusing hour or so tussling with the would be hacker and me in the backend of the site. He was busy deleting articles, I was busy deleting his user.

The j.org team have released a fix already. Its a critical security patch and part of 1.5.6. You should update your site ASAP if you are running Joomla 1.5.

On a r [...]