July 2nd, 2006
Mambo and Joomla do the Chicken Dance
Netcraft is reporting that the opensource content management system Mambo and its errant step daughter Joomla both are vulnerable to simple SQL insertion attacks. This means that a hacker can use form fields to crack into the server hosting the website. Both sites have posted security updates. Mambo gives users two lines to add to the underlying PHP code.
There are thousands of sites, some large commercial operations, running these CMS systems. I am still waiting for the first round of Web 2.0 (Writely, 30boxes, etc.) vulns to be revealed. They are there. Just waiting to be discovered.
Richard Stiennon is an industry consultant. See his full profile and disclosure of his industry affiliations.
