Hi all,

Just a little heads up

Over the past 24 hours my Joomla administrator password has been reset twice by hackers. Looking back into my access log I noticed that both times, the hacker had accessed my site using the following google search:

http://www.google.com.sa/search?hl=ar&safe=active&q=inurl:index.php%3Foption%3Dcom_lyftenbloggie&start=60&sa=N

I'm just a little concerned that someone has found a method of using lyften bloggie to gain access to people's Joomla sites...

Regards,

Mark

Having read this I did a quick search and it seems that there is indeed an SQL injection vulnerability in this version or earlier versions. Are there plans to fix this exploit because it looks the dogs bolloks and I am nervous about installing it.

Please advise if there is a solution to a particular file that might need patched.

DO NOT INSTALL! lyften bloggie is an easy gateway for hackers to FIND YOU, and HACK YOUR SITE. after many frustrating hours of trying to figure out why 3 of my sites have been hacked over the past week, i finally discovered that this is how they found my site:

http://www.google.com/search?hl=en&source=hp&q=inurl%3A+com_lyftenbloggie&aq=f&oq=&aqi=

Please fix this security vulnerability ASAP! Also i strongly recommend using SEF extensions on your site. You DO NOT want your site coming up on google associated with lyften bloggie.

Thanks for the warning. I'll find an alternative till they fix this.

Are they planning to fix it? By all accounts the exploits been there for a while.

My site was just hacked!!I suspect Lyften Bloggie was exploited.

The hacker was NOT able to get into my admin console, but redirected the index page to a "you have been been hacked" web page. I too received admin e-mails suggesting that I requested a password reset.  Lucky for me, I had the good sense not to respond, otherwise I believe the hacker could have taken admin control.  If you receive such an email DO NOT respond.

Site is down for maintenance!

luckily i can restore my sites to the previous day, but i realized that backing up my "includes" folder was all i really need to do. they are not getting into the db (thank god). so the most damage they've done is redirect the site from the includes folder, and reset my admin password in the process. it's really more of a pain in the ass than anything. i have some sites that use this blog though, and i'm afraid they are sitting ducks for a hacker. it would be cool if someone could look into this, or respond to this vulnerability... 

To fix the problem follow the instructions Jeff Channell has provided: 

http://www.jeffchannell.com/Joomla/lyften-bloggie-sql-injection-fix.html

^ Yes, make the above fix on any LyftenBloggie install you have.

Also, running your blog under SEO can mask the lyftenbloggie search string used in the earlier hacks (mine never uses the word lyftenbloggie publicly).

The Lyften author really needs to respond to this if this project is to survive.

just curious, has anyone been hacked after using the patched code? i have one site using this blog (with SEF) that seems to be safe. but i want to be sure no one else is getting hacked before i feel comfortable using this again...

I've gone for K2 which seemed to suit the clients needs and with the author not responding to this threat personally I'm glad I chose something else.