JCE/Image Manager vulnerability? NOT on SiteGround servers anymore!

Few days ago our security team has come across a JCE related vulnerability that has the potential to affect many Joomla 1.5.x based websites. The problem is that an old version of one of the JCE addons called ImageManager has turned out to be vulnerable to attacks. The number of the affected websites is big, because many templates  providers include the JCE editor together with ImageManager as part of their template bundle installations. So many Joomla users have these extensions without having installed them themselves.

After we noticed that few of our customers are hacked this way, we have immediately intervened in order to prevent this from spreading on our servers. Our security team has added custom rules to our Apache servers that will block any attempts for hacking Joomla 1.5 sites through this security hole. In addition, files with malicious code have been identified and removed immediately. If you’re a SiteGround user and think your website is compromised, please contact our Technical Support Team and we will take a look at it immediately.

However, we strongly recommend that all Joomla 1.5 users check if JCE with ImageManager is included in their installation and make sure to update both to their latest versions.

And another side note: if you use Joomla 1.5 you should seriously consider moving to Joomla 2.5 as soon as possible. The whole 1.5 branch is no longer supported by Joomla and though it has been stable for a long time and has no known security issue at the moment, if one occurs in the future (say tomorrow) it will not be fixed. So as always the number one rule to stay safe is: always use up-to-date applications and extensions so you stay one step ahead of the hackers!