Skip to main content
Share Your Experience: Take the 2024 Developer Survey
14 votes
Accepted

How did hackers manage to create a new user while "allow user registration" is set to "NO"?

The main reason for 3.6.4 update was exactly what happened to you! Security Bulletin [20161001] - Core - Account Creation states "Inadequate checks allows for users to register on a site when ...
Mikan's user avatar
  • 3,007
8 votes
Accepted

Is it possible to load a newer jQuery version?

Or does Joomla really need the 1.x version? Joomla itself may work mostly fine with newer jQuery versions. The reason it ships with such an old version is compatibility for 3rd party extensions. So ...
Sharky's user avatar
  • 11.4k
5 votes
Accepted

Generating static pages out of Joomla?

The "Static Content" project at: https://github.com/juliopontes/staticcontent does exactly what you are after although it looks like it may need to be updated for Joomla 3.5. Alternatively, you could ...
Neil Robertson's user avatar
5 votes
Accepted

What to do with hacker attempts to guess my Admin Password and login in backend?

the most simple thing you can do, is to put a username and password for your administrator folder in cpanel. this way you should first input the username and password to see the Joomla login page.
kiasaty's user avatar
  • 661
5 votes
Accepted

Is it secure to work with JCE?

The article starts with the text: Throwback Threat Thursday is a series of posts where we recall older vulnerabilities that have since been patched by their developers. In the past, these ...
pe7er's user avatar
  • 2,058
4 votes
Accepted

You must provide at least one recipient email address (when saving Global Configuration)

Hmm, I think I sorted out from where this notice is coming from. It looks like responsible for this is the latest version of Akeeba Admin Tools Pro (maybe it's also in the free core version don't know ...
FFrewin's user avatar
  • 19.7k
4 votes
Accepted

Security Alternative to updating to 3.6.4

GRR stop modifying core files! Apart from some basic XML files being updated to cater for the version, only 3 actual core PHP files were updated to fix the security exploit. administrator\components\...
Lodder's user avatar
  • 26.9k
4 votes
Accepted

Unable to Access Backend - Masked for frontend

As you mentioned, this is usually the behavior of security extensions like admintools, jSecure to protect the administration area of a Joomla site. If you can't tell if you have any of these, think ...
FFrewin's user avatar
  • 19.7k
3 votes

How to secure a new Joomla installation?

Your first line of defense is your hosting service Lease a dedicated server from a reliable hosting service Ensure that you activate 2FA on your server and use a 'VERY STRONG' password Install a ...
Luke Douglas's user avatar
3 votes

Site gets hacked and everytime a new user is created with Admin rights

There are many resources you can find regarding a Joomla hacked site, either by googling it, or simply searching in this site. Here are some links: What to do if my Joomla website got hacked? How ...
FFrewin's user avatar
  • 19.7k
3 votes
Accepted

How can I use Joomla's 'Escape' method if I'm using an abstract class to construct data?

Use direct PHP function: htmlspecialchars($row->tooltip, ENT_COMPAT, 'UTF-8');
Nagarjun's user avatar
  • 3,001
3 votes

What to do with hacker attempts to guess my Admin Password and login in backend?

Joomla is a well known CMS and it's normally very easy to detect whether or not a site is powered by Joomla. Because of this, knowing the URL of the administrator page is easy to find. With that in ...
Lodder's user avatar
  • 26.9k
3 votes
Accepted

Site keeps browsing itself all the time

I do not see this as a Joomla issue (except the .htaccess file in Joomla root). From the small part of the log you provided in your question we can clearly read that the requests are made by ...
Zollie's user avatar
  • 2,936
3 votes

How to find the version of extensions used on a Joomla website without access to the backend?

If you're not an administrator of the site, you can't have this information in full. If you know which extensions are installed, you can check their versions by accessing their manifest files. For ...
Sharky's user avatar
  • 11.4k
3 votes
Accepted

How to find the version of extensions used on a Joomla website without access to the backend?

As @Sharky said, you can check the extension versions by accessing their manifest files. Here are the path of those files for each type of extension : Component : ../administrator/components/...
webchun's user avatar
  • 2,418
3 votes
Accepted

What are the code changes for the Security patch vulnerability in 3.9.9

Changes for security patches are normally hidden further down in the commit history or sometimes in the actual release commit to throw people off. In this case, the security patch is in the release ...
Lodder's user avatar
  • 26.9k
3 votes

Which line should PHP files in Joomla start with?

It makes no difference when used in extensions. But if you want to be technically correct, _JEXEC is the one to use. It's declared earliest, in the entry point file (i.e. index.php), and its sole ...
Sharky's user avatar
  • 11.4k
2 votes

Joomla - Upgrade Version 3.2.3 to 3.4.7

Step 1: You should take a backup of your site, either manually or using Akeeba Backup. The upgrade can be done using Joomla's 1 click update feature in the admin back-end. Go to: Components >> ...
Lodder's user avatar
  • 26.9k
2 votes

Media component reporting 'Possible IE XSS Attack'

I know that's odd (still in Joomla 3.5.0). In the function canUpload($file, $component = 'com_media') of class JHelperMedia, this is within /libraries/cms/helper/media.php a check for serveral tags ...
Tom Kuschel's user avatar
2 votes
Accepted

Did my site get hacked?

A bunch of have have posted numerous answers on Joomla Stack Exchange about what to to in case of a site being hacked. My suggestion first would be to delete the index_old.php file, then remove the ...
Lodder's user avatar
  • 26.9k
2 votes
Accepted

Why is Norton blocking access to my site?

In my years of using Joomla I've never had any antivirus block a site so it's a new one to me. Here is a checklist of things to try: Main: Ensure Joomla is up to date Ensure 3rd party extensions are ...
Lodder's user avatar
  • 26.9k
2 votes

Sitelock Found High Priority Security Issue Joomla 3.5.1

Really really simple solution and cant believe no one has said it. Upgrade to the latest version of Joomla. You are many versions behind
Brian Teeman's user avatar
2 votes
Accepted

403 Forbidden Access, when accessing custom html/php files directly

You must customize this part or remove it at all: #index.php to root RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+/)*index\.(html?|php)\ HTTP/ RewriteCond %{REQUEST_URI} !^/administrator/ ...
Alexandr's user avatar
  • 1,130
2 votes

Joomla 3 and Google Security Issues - Security Issues

Redirecting the links is probably a short term solution at best. Ideally you need to find and fix the hacker's point of entry (e.g. update Joomla and all third party extensions to the latest versions)...
Neil Robertson's user avatar
2 votes

How did hackers manage to create a new user while "allow user registration" is set to "NO"?

There are many possible ways that the hacker has broken into your web, I recommend you see these documents: https://docs.joomla.org/Security As to your question I would bet that the hacker could ...
Piero Marsilio's user avatar
2 votes

Access Denied, what am I overlooking?

According to the Joomla! Documentation: Joomla! uses the templates/system/error.php file to handle several HTTP Status errors, including "403 Forbidden", "404 Not Found", and "500 Internal ...
PaxAnura's user avatar
2 votes
Accepted

Manual update to Joomla 2.5.999 for 3.6.5 update

I did start writing out all the code you'll need but as you know, Joomla 2.5 differs and I haven't worked with it for a long time, so I won't go down that route. Step 1: Take a backup of your site ...
Lodder's user avatar
  • 26.9k
2 votes

Finding a clean version of extensions during Joomla! migration?

Unfortunately, the extension table does not contain installed version or extension author information. To document this additional third party extension information, I recommend: logging in to the ...
Neil Robertson's user avatar
2 votes
Accepted

Finding a clean version of extensions during Joomla! migration?

I think that the sequence that you're using is not what it should be. You should first do the following: Install a fresh install of Joomla (same version that you have) Find all the extensions that ...
itoctopus's user avatar
  • 3,226
2 votes

Manual update to Joomla 2.5.999 for 3.6.5 update

VirtueMart has released a Joomla 2.5.28 Patch which can be found here: https://dev.virtuemart.net/projects/virtuemart/activity Of course use it with caution and backup before patching.
FFrewin's user avatar
  • 19.7k

Only top scored, non community-wiki answers of a minimum length are eligible