Acajoom Component for Mambo/Joomla! Backdoor Vulnerability

Bugtraq ID:	35459
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 22 2009 12:00AM
Updated:	Jul 24 2009 08:36PM
Credit:	Jan van Niekerk
Vulnerable:	Joobi Ltd Acajoom 4.0 Joobi Ltd Acajoom 3.2.6
Not Vulnerable:	Joobi Ltd Acajoom 3.2.7

Acajoom Component for Mambo/Joomla! Backdoor Vulnerability

Acajoom is prone to a backdoor vulnerability.

Attackers can exploit this issue to execute arbitrary commands in the context of the application. Successful attacks will compromise the affected application and possibly the webserver or computer.

Acajoom 3.2.6 is vulnerable; prior versions may also be affected.

UPDATE (July 23, 2009): Reports indicate that some releases of Acajoom 4.0.0 may also be vulnerable.

Acajoom Component for Mambo/Joomla! Backdoor Vulnerability

Attackers can use a browser to exploit this issue.

Acajoom Component for Mambo/Joomla! Backdoor Vulnerability

Solution:
Updates are available. Please see the references for details.

Acajoom Component for Mambo/Joomla! Backdoor Vulnerability

References:

• Acajoom Homepage (Joobi Ltd)
  
• Upgrade Highly recommended for Acajoom GPL 3.2.7 (Joobi Ltd)
  
• Back door trojan in acajoom-3.2.6 for joomla (Jan van Niekerk )
  
• Back door trojan in acajoom-3.2.6 for joomla (Jan van Niekerk )
  
• Re: Re: Back door trojan in acajoom-3.2.6 for joomla ([email protected])