IT Security: unpatched Joomla sites allow phishing scams to hide

South Africa's First National Bank is a frequent subject of phishing attacks.

An example which arrived at the offices of The Anti Money Laundering Network, parent company of Vortex Centrum, publishers of ChiefOfficers.Net exploits a security hole in unpatched versions of Joomla!, one of the most popular content management systems for small-to-medium websites and used by many companies, universities and other organisations.

The breach is exploited in the /modules/mod_breadcrumbs/tmpl/default/mammoth directory. Fraudsters are able to place a "landing page" in that directory which receives visitors from a widespread spam-scam e-mail. "mammoth" is a popular "theme" for both Joomla! and Wordpress. It is not known if the vulnerability is also present in the equivalent Wordpress directory.