Re: Mambo Server hacks

2005-12-15 Thread chefren
On 11/26/05 11:58, Bruno S. Delbono wrote: Is there a better, more secure replacement as a CMS? If you are interested in a KISS approach take a look at TinyMCE, an easy to configure JavaScript WYSIWYG(!!!) editor: http://tinymce.moxiecode.com/example_full.php?example=true (Instantly drop

Re: Mambo Server hacks

2005-11-27 Thread Fabien Germain
On 11/27/05, Bruno S. Delbono [EMAIL PROTECTED] wrote: Is there a secure php CMS that any of you might have had experience with (knowing full well that php and security are an oxymoron) Did you try SPIP (http://www.spip.net) ? Several big french websites use it. Fabien

Mambo Server hacks

2005-11-26 Thread Bruno S. Delbono
Hi All, One of our servers got hacked this morning. The culprit turned out to be mambo. This is a second time this has happened with mambo and I am ready to junk it. Is there a better, more secure replacement as a CMS? PS - Here is the 0-day expolit (for all versions of mambo not protected)

Re: Mambo Server hacks

2005-11-26 Thread Jasper Lievisse Adriaanse
On Sat, 26 Nov 2005 02:58:48 -0800 Bruno S. Delbono [EMAIL PROTECTED] wrote: Hi All, One of our servers got hacked this morning. The culprit turned out to be mambo. This is a second time this has happened with mambo and I am ready to junk it. I would've junked it the first time though. Is

Re: Mambo Server hacks

2005-11-26 Thread Edd Barrett
Is there a better, more secure replacement as a CMS? Tried postnuke or phpnuke or one of the other hundreds of varients based around the word nuke? I love the way these people have a website telling you all about them. Regards Edd

Re: Mambo Server hacks

2005-11-26 Thread Gaby vanhegan
On 26 Nov 2005, at 11:18, Edd Barrett wrote: Is there a better, more secure replacement as a CMS? Tried postnuke or phpnuke or one of the other hundreds of varients based around the word nuke? I've heard that they're not great in terms of security either. Have you considered Ruby on Rails?

Re: Mambo Server hacks

2005-11-26 Thread J.C. Roberts
On Sat, 26 Nov 2005 02:58:48 -0800, Bruno S. Delbono [EMAIL PROTECTED] wrote: Hi All, One of our servers got hacked this morning. The culprit turned out to be mambo. This is a second time this has happened with mambo and I am ready to junk it. Is there a better, more secure replacement as a

Re: Mambo Server hacks

2005-11-26 Thread knitti
this is a bit off-topic, but hey On 11/26/05, Bruno S. Delbono [EMAIL PROTECTED] wrote: Is there a better, more secure replacement as a CMS? use google, there are tons of cms out there, your question is obviously too generic. look at their vulnerabilities, look at their code, look at their

Re: Mambo Server hacks

2005-11-26 Thread Darrin Chandler
knitti wrote: try avoiding anything in php. try avoiding anything in perl. yes, with both languages it is _possible_ to write secure code, but actually very seldom practiced. Everything else is a matter of taste and the task to solve. This is a shame about perl, but I can't say you're wrong.

Re: Mambo Server hacks

2005-11-26 Thread Bernd Schoeller
On Sat, Nov 26, 2005 at 09:36:46AM -0700, Darrin Chandler wrote: But this isn't really a perl problem, or a php problem. It's possible to write secure code in many environments, but it's not easy. Most cms developers worry more about having tons of features than about secure code. Security is

Re: Mambo Server hacks

2005-11-26 Thread frantisek holop
hmm, on Sat, Nov 26, 2005 at 04:56:41PM +0100, knitti said that try avoiding anything in php. try avoiding anything in perl. yes, with that is a silly advice. if one knows what to look for, php and perl are just as secure as anything else. as with anything else, there are security conscious

Re: Mambo Server hacks

2005-11-26 Thread Jason Dixon
On Nov 26, 2005, at 7:39 PM, frantisek holop wrote: hmm, on Sat, Nov 26, 2005 at 04:56:41PM +0100, knitti said that try avoiding anything in php. try avoiding anything in perl. yes, with that is a silly advice. if one knows what to look for, php and perl are just as secure as anything