Support

Hi Guys

I'm not sure if this is the same report as shown previously, as I didn't see the message there.

I'm seeing streams of these on my site, if I get one, I get 20 or more:

Country: (unknown country) Continent: (unknown continent) IP Address: dirname(JFactory::getConfig()->get(base64_decode(XXXXXXXXX))).base64_decode(XXXXXXXXX));exit;";s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;} (IP Lookup: IP Lookup)Reason: MUA Shield

So is this the old 'agent string' attack that gives these odd messages?

Best regards
Kenneth

Hi Kenneth,

I don't know if this attack has a name. It worked on Joomla! versions 3.5 and prior by putting executable code in the from IP field and then tricking Joomla! into executing the code. Your up-to-date version of Joomla! is immune to the attack and Admin Tools is blocking it as well so you are safe.

We've seen a LOT of these attacks over the last month or so.

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.