hey all
my sites where hacked and the system admin requested that I refer to http://xforce.iss.net/xforce/xfdb/27469 (a link from 2006)
is there a fix? one of these sites is running 1.4.1??? (I am updating my other one from 1.3.1 (ya ya I know old . . .)

DAVE

That attack is only feasible if register globals is on. Also, $_CONF['path'] is never referenced by the code before it is overwritten in config.php. So while this attack is potentially a problem it would be impossible to exploit without other security holes allowing the user to upload arbitrary files to arbitrary directories.

Looking through the list of files, all of them have code that prevents them from being loaded directly from a browser. So that also stops this attack cold:

This has long been fixed and only applied to sites that didn't follow the installation instructions anyway (plus have register_globals = on, as Joe pointed out).