On December 14, the Joomla project released version 3.4.6. This fixes a highly critical security vulnerability that affects Joomla 1.5 through 3.4.5. This vulnerability can be exploited by attackers to remotely execute code.
If you are using the old (unsupported) versions 1.5.x and 2.5.x, you have to apply the hotfixes from here. This article from OSTraining explains how to apply them.
This critical vulnerability can be exploited to extract a browser cookie which can be used to provide the attacker with administrator privileges. If that cookie is loaded into the browser, the hacker can gain access to the back end of the website and can access the administrator control panel. The code required to exploit the vulnerability has already been posted online.
Once access has been gained, files can be downloaded including confidential customer information. Since Joomla is used to create e-commerce websites, customers who have previously purchased products through Joomla websites could have their confidential information stolen.
It is therefore imperative that all administrators of Joomla sites update their website software immediately and patch the critical Joomla vulnerability in order to secure their sites.
We do offer customers a malware cleanup service; Sucuri Malware Cleanup and Blacklist Removal; http://www.myhost.ie/hosting/malware-removal/
We also offer a website firewall service which actively prevents these sorts of attack; http://www.myhost.ie/hosting/website-firewall/
This will actively protect your website by monitoring website traffic and dropping malicious connections. It also prevents attacks on vulnerable outdated sites,
using ‘Virtual Website Patching’, which means the site appears fully up to date to any malicious connections.
