Just a general warning that there are some nasty security issues with Joomla 1.5. In particular, it's possible to reset the admin password with no special attack code!!

Here's the notification from WHT:
http://www.webhostingtalk.com/showthread.php?t=714987

I'm sure there are others but this one seemed particularly nasty to me!

Here's a working and tested mod_security 1.x pattern for this and one other issue:

The patterns may be a little general, comments appreciated!

ps: there are exploits in the wild for this one!

Thanks brianoz, we've applied those mod_security patches

It really annoys me when popular software has major security holes in it. I'm a PHP developer and I always drilled security in to myself as the number one priority when writing applications. I can't be 100% sure but I'm quite confident that nothing I have written has glaring security holes in it, and I expect the same from developers who release software for other people to use.

Especially gaping security holes like these. I'd expect better from the Joomla folks; any password changing page should be reviewed 4-5 times by different people before going live, and should double or triple check incoming data. Kind of Programming 101. And don't get me started on allowing SQL injection; that's old hat now to anyone ... even phpBB get this right these days!!!

Reason why I don't use Joomla, its basically another PHP Nuke.......

What about your clients though? Can they install Joomla with or without permission?

Why should it matter?
Its only their Joomla installation thats at risk. It doesnt breach server security.

Once they have control of a Joomla installation, it's only a few steps to getting full control of an account, often (for instance, if they've used their cpanel password as a database password). And from there, if the server isn't well secured, it's not hard to escalate to root.

So yes, it's important

IF your servers insecure, then thats a seperate issue unrelated to the joomla problem. The server should be secure, or your just inviting trouble even from your regular users, weather joomla is installed or not.

But you got a point about the database. Mind you, youd be rather stupid to use the same password for both :P

And of course, I completely agree re the insecure server. But not all the hosters out there know how to secure a server well as I'm sure you know!

And you or I (and I'm sure all the people reading here) would never use a cpanel password for a database... but that's not the way users work!

Joomla had a lot of security issues, why dont you give mambo a try?

You do realise that Joomla was Mambo to begin with, don't you?

No, i thought they are two completely different Content management Systems.

Joomla starting to turn into a PHP Nuke with all the exploit problems.