Website with Joombah Jobs Hacked - Joomla! Forum - community, help and support

i running joombah site (not listed vulnerable extension: http://docs.joomla.org/vulnerable_extensions_list) hacked. hacker registered job seeker, proceeded upload files using resumé upload feature. in case hacker uploaded php script, using jpg extension script, able exploit using php interpreter. host has informed me possible using other file extensions (.doc, .docx, etc), depending on how rewrite implemented in htaccess (the htaccess file in place @ time of attack attached).

edit: hacker did upload php script jpg extension, not complete story of how did hack. security reasons, not going post more actual exploit.

it appears hacker able upload separate php script used send out spam.

i running joombah 1.3.3 and, admittedly, joomla 2.5.4 (which have since updated 2.5.8). have pm'd admin of joombah forums (approx 15 hours ago) , posted on forums still have not received response.

problem description :: forum post assistant (v1.2.3) : 14th november 2012 wrote:site hacked uploading php script disguised jpg or possibly doc/docx file

actions taken resolve forum post assistant (v1.2.3) 14th november 2012 wrote:site taken offiline.
upgraded joomla 2.5.4 2.5.8
contacted (and still awaiting response) joombah re hack

forum post assistant (v1.2.3) : 14th november 2012 wrote:

basic environment :: wrote:joomla! instance :: joomla! 2.5.8-stable (ember) 8-november-2012
joomla! platform :: joomla platform 11.4.0-stable (brian kernighan) 03-jan-2012
joomla! configured :: yes | read-only (444) | owner: website (uid: 1/gid: 1) | group: website (gid: 1) | valid for: 2.5
configuration options :: offline: 0 | sef: 1 | sef suffix: 0 | sef rewrite: 1 | .htaccess/web.config: yes | gzip: 1 | cache: 0 | ftp layer: 0 | ssl: 0 | error reporting: default | site debug: 0 | language debug: 0 | default access: 1 | unicode slugs: 0 | database credentials present: yes

host configuration :: os: linux | os version: 2.6.32.49-grsec | technology: x86_64 | web server: apache | encoding: gzip,deflate,sdch | doc root: /home/website/www/www | system tmp writable: yes

php configuration :: version: 5.3.17 | php api: cgi-fcgi | session path writable: unknown | display errors: | error reporting: 22519 | log errors to: | last known error: | register globals: | magic quotes: 1 | safe mode: 0 | open base: | uploads: 1 | max. upload size: 20m | max. post size: 20m | max. input time: -1 | max. execution time: 120 | memory limit: 80m

mysql configuration :: version: 5.5.27-percona-sure1-log (client:5.5.27-percona-sure1) | host: --protected-- (--protected--) | collation: utf8_general_ci (character set: utf8) | database size: 17.36 mib | #of tables:  180

detailed environment :: wrote:php extensions :: core (5.3.17) | date (5.3.17) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7-dev) | zlib (1.1) | bcmath () | bz2 () | calendar () | ctype () | curl () | dom (20031129) | hash (1.0) | fileinfo (1.0.5-dev) | filter (0.11.0) | ftp () | gd () | gettext () | spl (0.2) | iconv () | session () | intl (1.1.0) | json (1.2.1) | ldap () | mbstring () | mcrypt () | mysql (1.0) | mysqli (0.1) | pcntl () | standard (5.3.17) | pdo (1.0.4dev) | pdo_mysql (1.0.2) | pdo_sqlite (1.0.1) | phar (2.0.1) | posix () | pspell () | reflection ($id: 593a0506b01337cfaf9f63ebc12cd60523fc2c41 $) | imap () | simplexml (0.1) | soap () | sockets () | sqlite (2.0-dev) | exif (1.4 $id$) | sureacct (0.1) | tidy (2.0) | tokenizer (0.1) | xml () | xmlreader (0.1) | xmlwriter (0.1) | xsl (0.1) | zip (1.11.0) | cgi-fcgi () | mhash () | ioncube loader () | zend engine (2.3.0) |
potential missing extensions :: suhosin |

switch user environment (experimental) :: php cgi: yes | server su: yes | php su: yes | custom su (litespeed/cloud/grid): yes
potential ownership issues: no

folder permissions :: wrote:core folders :: --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) | --protected-- (755) |

elevated permissions (first 10) :: --protected-- (775) | --protected-- (775) | --protected-- (775) | --protected-- (775) | --protected-- (775) |

extensions discovered :: wrote:strict information privacy selected. nothing display.

templates discovered :: wrote:_fpa_strict information privacy nothing display.

additional log information below (with hacker's ip , domain obfuscated)

www-02.log.gz:12.345.678.90 - - [02/nov/2012:21:58:50 -0400] "post /jobs/index.php?option=com_jbjobs&task=checkuser http/1.1" 200 14 "http://www.website.org/jobs/index.php?option=com_jbjobs&view=jobseeker&layout=regjobseekernew" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

www-02.log.gz:12.345.678.90 - - [02/nov/2012:21:59:34 -0400] "post /jobs/index.php http/1.1" 303 5 "http://www.website.org/jobs/index.php?option=com_jbjobs&view=jobseeker&layout=regjobseekernew" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

www-02.log.gz:12.345.678.90 - - [02/nov/2012:22:04:47 -0400] "post /jobs/index.php http/1.1" 303 5 "http://www.website.org/jobs/index.php?option=com_jbjobs&view=jobseeker&layout=regjobseekernew" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

www-02.log.gz:12.345.678.90 - - [02/nov/2012:22:04:56 -0400] "post /jobs/component/jbjobs/jobseeker/index.php?option=com_jbjobs&task=checkuser http/1.1" 200 69 "http://www.website.org/jobs/component/jbjobs/jobseeker/regjobseekernew" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

www-02.log.gz:12.345.678.90 - - [02/nov/2012:22:05:29 -0400] "post /jobs/component/users/?task=user.login http/1.1" 303 5 "http://www.website.org/jobs/component/users/?view=login" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

www-02.log.gz:12.345.678.90 - - [02/nov/2012:22:05:59 -0400] "post /jobs/open-jobs/employer-logindashboard/jobseeker/index.php http/1.1" 303 5 "http://www.website.org/jobs/open-jobs/employer-logindashboard/jobseeker/regjobseeker" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

www-02.log.gz:12.345.678.90 - - [02/nov/2012:22:06:28 -0400] "post /jobs/open-jobs/employer-logindashboard/jobseeker/index.php http/1.1" 303 5 "http://www.website.org/jobs/open-jobs/employer-logindashboard/jobseeker/editresume" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

www-02.log.gz:12.345.678.90 - - [02/nov/2012:22:06:43 -0400] "post /jobs/open-jobs/employer-logindashboard/jobseeker/index.php http/1.1" 303 5 "http://www.website.org/jobs/open-jobs/employer-logindashboard/jobseeker/editresume" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

www-02.log.gz:12.345.678.90 - - [02/nov/2012:22:34:28 -0400] "post /jobs/images/jbjobs/pf/p_259_1351908403.php http/1.1" 200 358 "http://www.website.org/jobs/images/jbjobs/pf/p_259_1351908403.php" "mozilla/5.0 (windows nt 6.1; rv:15.0) gecko/20100101 firefox/15.0.1"

mods: have copy of fake jpg file/php script. if can pm contents of you.

any help/advice on go next button issue down appreciated.

not sure if matters (for use extensions), "check mime types" enabled in media manager.