Mysterious new thumbnails

Multilinus

Hi,

for security reasons, I am regularly checking my Joomla 3.x installation for new files. In this installation I am using AcyMailing Starter 8.2.0.

Yesterday I discovered two new and mysterious files in the thumbnail directory of AcyMailing:

/media/com_acym/images/thumbnails/thumbnail_98.png?.php
New date/time: 2023-05-04 03:13:23, size: 592
and
/media/com_acym/images/thumbnails/thumbnail_98.php.png
New date/time: 2023-05-04 03:18:00, size: 546

For security reasons, I deleted both files.

Today this directory contained again two new and mysterious files:

/media/com_acym/images/thumbnails/thumbnail_199.php.png
New date/time: 2023-05-05 03:12:00, size: 29
and
/media/com_acym/images/thumbnails/thumbnail_199.png?.php
New date/time: 2023-05-05 05:29:14, size: 29

I have no explanation why these mysterious files appeared in this directory. Is there a way to find an explanation for that?

Thank you in advance for any advice.

jvstratum

Hi,

We are aware of the issue and have prepared a patch for the next version to add extra security checks
.
In the meantime, you can edit the file administrator/components/com_acym/controllers/mails/Edition.php and in the setNewThumbnail function near line 800, add this code:

exit;

It should look like this:

Multilinus

Thank you for this quick reply. It is good to know that you are aware of the issue.

I also would like to add the recommended code. Unfortunately, in my AcyMailing Starter 8.2.0 version, I don't find a directory like

administrator/components/com_acym/controllers/mails/

The path goes only to

administrator/components/com_acym/controllers/

And there is no file like 'Edition.php'. There is a file 'mails.php'. It seem to contain a similar code near line 1080:

Would it make sense to add here the code 'exit;'?

jvstratum

Yes that would make sense.

mihha

It would make even more sense to upgrade AcyMailing to the latest version and then apply the code that was suggested