Re: Mambo Server hacks

2005-12-15 Thread chefren
On 11/26/05 11:58, Bruno S. Delbono wrote: Is there a better, more secure replacement as a CMS? If you are interested in a KISS approach take a look at TinyMCE, an easy to configure JavaScript WYSIWYG(!!!) editor: http://tinymce.moxiecode.com/example_full.php?example=true (Instantly drop a

Re: Mambo Server hacks

2005-11-27 Thread Fabien Germain
On 11/27/05, Bruno S. Delbono <[EMAIL PROTECTED]> wrote: > > Is there a secure php CMS that any of you might have had experience with > (knowing full well that php and security are an oxymoron) Did you try SPIP (http://www.spip.net) ? Several big french websites use it. Fabien

Re: Mambo Server hacks

2005-11-26 Thread Jason Dixon
On Nov 26, 2005, at 7:39 PM, frantisek holop wrote: hmm, on Sat, Nov 26, 2005 at 04:56:41PM +0100, knitti said that try avoiding anything in php. try avoiding anything in perl. yes, with that is a silly advice. if one knows what to look for, php and perl are just as secure as anything else.

Re: Mambo Server hacks

2005-11-26 Thread Bruno S. Delbono
Gaby vanhegan wrote: On 26 Nov 2005, at 11:18, Edd Barrett wrote: Is there a better, more secure replacement as a CMS? Tried postnuke or phpnuke or one of the other hundreds of varients based around the word "nuke"? Well, I have just look at ruby on rails and plone. They are both neat pro

Re: Mambo Server hacks

2005-11-26 Thread frantisek holop
hmm, on Sat, Nov 26, 2005 at 04:56:41PM +0100, knitti said that > try avoiding anything in php. try avoiding anything in perl. yes, with that is a silly advice. if one knows what to look for, php and perl are just as secure as anything else. as with anything else, there are security conscious ph

Re: Mambo Server hacks

2005-11-26 Thread Stephan A. Rickauer
Bruno S. Delbono wrote: Is there a better, more secure replacement as a CMS? typo3 Stephan

Re: Mambo Server hacks

2005-11-26 Thread Bernd Schoeller
On Sat, Nov 26, 2005 at 09:36:46AM -0700, Darrin Chandler wrote: > But this isn't really a perl problem, or a php problem. It's possible to > write secure code in many environments, but it's not easy. Most cms > developers worry more about having tons of features than about secure > code. "Security

Re: Mambo Server hacks

2005-11-26 Thread Darrin Chandler
knitti wrote: try avoiding anything in php. try avoiding anything in perl. yes, with both languages it is _possible_ to write secure code, but actually very seldom practiced. Everything else is a matter of taste and the task to solve. This is a shame about perl, but I can't say you're wrong.

Re: Mambo Server hacks

2005-11-26 Thread knitti
this is a bit off-topic, but hey On 11/26/05, Bruno S. Delbono <[EMAIL PROTECTED]> wrote: > Is there a better, more secure replacement as a CMS? use google, there are tons of cms out there, your question is obviously too generic. look at their vulnerabilities, look at their code, look at their

Re: Mambo Server hacks

2005-11-26 Thread J.C. Roberts
On Sat, 26 Nov 2005 02:58:48 -0800, "Bruno S. Delbono" <[EMAIL PROTECTED]> wrote: >Hi All, > >One of our servers got hacked this morning. The culprit turned out to be >mambo. This is a second time this has happened with mambo and I am ready >to junk it. > >Is there a better, more secure replacem

Re: Mambo Server hacks

2005-11-26 Thread Gaby vanhegan
On 26 Nov 2005, at 11:18, Edd Barrett wrote: >> Is there a better, more secure replacement as a CMS? > > Tried postnuke or phpnuke or one of the other hundreds of varients > based around the word "nuke"? I've heard that they're not great in terms of security either. Have you considered Ruby on R

Re: Mambo Server hacks

2005-11-26 Thread Edd Barrett
> Is there a better, more secure replacement as a CMS? Tried postnuke or phpnuke or one of the other hundreds of varients based around the word "nuke"? I love the way these people have a website telling you all about them. Regards Edd

Re: Mambo Server hacks

2005-11-26 Thread Jasper Lievisse Adriaanse
On Sat, 26 Nov 2005 02:58:48 -0800 "Bruno S. Delbono" <[EMAIL PROTECTED]> wrote: > Hi All, > > One of our servers got hacked this morning. The culprit turned out to be > mambo. This is a second time this has happened with mambo and I am ready > to junk it. I would've junked it the first time thoug

Mambo Server hacks

2005-11-26 Thread Bruno S. Delbono
Hi All, One of our servers got hacked this morning. The culprit turned out to be mambo. This is a second time this has happened with mambo and I am ready to junk it. Is there a better, more secure replacement as a CMS? PS - Here is the 0-day expolit (for all versions of mambo not protected)