Phil-A-Form v1.2 And Lower - SQL Injection
May 29th, 2007
The current version of Phil-A-Form is v1.6.3 - and is secure (as far as we know).
We have just been alerted to having a security vulnerability in VERSION 1.2 (Over a year old!) with SQL injection that allows a hacker to gain the md5 hash of the admin password on a Joomla Site.
We know MANY customers are still running Phil-a-form v1.2 which is vulnerable, in our tests we managed to get information from all the sites tested!
We are also aware that version 1.2 of Phil-A-Form is available on some warez/illegal sites.
Only versions less than v1.2 are vulnerable. PLEASE UPGRADE PHIL-A-FORM if you are not running the latest version.
This is another reason for making sure that all Joomla Components are kept up-to-date!
