Security and Open Source Content Management Systems (CMS)

21 April 2008 - By Sean Fishlock

It is every IT manager's nightmare. Your website has been hacked, defaced, private and sensitive information has possibly been compromised, possibly even exposing gateways to internal systems. This can happen to any business and due to the rapid expansion of the open source software industry is particularly effecting small business.

One of the often overlooked when evaluating web software is security. Choosing an open source CMS, for example, particularly the popular ones can leave you wide open to hackers. No matter what size of site your company is or how big or small your site is, this is something you should definitely take into account. Make sure you read between the lines.

Many of our competitors "sell" solutions which include these open source packages. This offers a price advantage, as they don't have to pay for the software they use in their solution. They will often choose the most popular systems, because they offer the most features and extensive communities. In doing so, they forfeit much control over the software that they build their solutions in, lack understanding on how it works and how to protect it from attack and unless they actively update and maintain the software and apply patches (which many don't), they leave their customer's security wide open. When they customise it, how do you know that they aren't exposing new holes in the software to attack ? This concerns you whether you outsource your website hosting or host your own website. Do you really know which system your developer has built your website with and how much do you trust it ?

Having been burnt on my own personal hobby projects by Mambo, Joomla and PHPBB (all open source systems), I can tell you first hand that it is not a pleasant experience when things go pear shaped and you don't know for why. While I had applied every update and patch available and although I did not customise one bit of code I had both of these systems hacked and it caused me a lot of frustration and pain to get the sites up and running again. I have also heard firsthand of many of the disasters that happen when uni students and amateur developers whack websites together with these tools. There is a big difference between this and a professional approach.
There are a few key principles to consider here: read more go here

http://www.datalink.com.au/company/blog/best_practice_strategy/open_source_cms_security

Backdoor Injection- Modules, Forums, Search etc.

Hacking web forms is by no means limited exclusively to login screens. A humble search form, for instance, is necessarily tied to a database, and can potentially be used to amend database details. Using SQL commands in search forms can potentially do some extremely powerful things, like calling up usernames and passwords, searching the database field set and field names, and amending same. Do people really get hacked through their search forms? You better believe it. And through forums, and anywhere else a user can input text into a field which interacts with the database. If security is low enough, the hacker can probe the database to get names of fields, then use commands like INSERT INTO, UNION, and so forth to get user information, change product prices, change account settings/balances, and just about anything else… depending on the security measures in place, database architecture and so on.

So you can have security locked down at the login, but poor security on other forms can still be exploited. Unfortunately this is a real worry regarding 3rd party modules for Web CMS???? products which incorporate forms, and for CMS products these 3rd party modules are often the weakest links which allows hackers access to your database.

source:http://www.cmswire.com/cms/web-cms/how-they-hack-your
-website-overview-of-common-techniques-002339.php