Support

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the tickets before posting? Yes
Have I read the documentation before posting Unhacking Your Site & others? Yes
Joomla! version: Joomla! 2.5.11 Stable [ Ember ] 26-April-2013 14:00 GMT
PHP version: 5.3.26
MySQL version: 5.5.30-cll
Host: Inmotion Hosting
Admin Tools version: PRO 2.5.6

Description of my issue:

Hello Nicholas,
I do have the .htaccess maker on and working fine, as well as web application firewall, and Super Admin ID# changed.

I had a scan done by 6scan and they had reported:
P‌ossib‌le SQ‌L inj‌ectio‌n cou‌ld al‌low h‌acker‌s to ‌manip‌ulate‌,stea‌l and‌ dest‌roy y‌our d‌ata.
Affected URL: /index.php
Vulnerability Name: Weblinks Component for Joomla! index.php Itemid Parameter SQL Injection
And suggested adding this code to the index.php file:

if ( isset( $_GET['itemid']) ){ $filtered_var = mysql_escape_string( $_GET['itemid'] ); $_GET['itemid'] = $filtered_var;}
if ( isset( $_POST['itemid']) ){ $filtered_var = mysql_escape_string( $_POST['itemid'] ); $_POST['itemid'] = $filtered_var;}
if ( isset( $_REQUEST['itemid']) ){ $filtered_var = mysql_escape_string( $_REQUEST['itemid'] ); $_REQUEST['itemid'] = $filtered_var;}

I could be wrong, however, I believe the Joomla index.php file can not be modified 'by other' with the .htaccess maker in use and as long as there are NO other exceptions added except - Template, Akkeba Backup, Admin Tools Pro, Joomla Update.

Could you please correct me if I am wrong? And is it necessary to really add this code? Is it a problem within Joomla? Your opinion?

Thanks - Drew