Site with outdated Joomla and suspicious redirect!

polonus · 2015-11-17T17:58:39.000Z

Suspicious conditional redirect. Details: http://sucuri.net/malware/entry/MW:HTA:7
Redirects users to:-http://www.couchtarts.com/media.php
index
Severity: Suspicious
Reason: Detected suspicious redirection to external web resources at HTTP level.
Details: Detected HTTP redirection to -http://www.couchtarts.com/media.php.
Pharmacy spam: -http://www.domxssscanner.com/scan?url=http%3A%2F%2Fdirttraxx.com%2Ftemplates%2Fredmoon%2Fscript.js
Landing at: Results from scanning URL: -http://www.peking-pharmacy.com/js/pptBox.js
Number of sources found: 4
Number of sinks found: 6

Joomla Version
1.5
Found in META Generator Tag Outdated. See: -http://www.domxssscanner.com/scan?
url=http%3A%2F%2Fwww.couchtarts.com

polonus

Para-Noid · 2015-11-17T22:25:19.000Z

In the redirect we find…

You were correct about cross scripting…
http://push2check.net/couchtarts.com (click on css for further results…not good)

polonus · 2015-11-17T22:39:29.000Z

So yes, good you analyzed and IT staff has another job for the day, I guess.

Damian (volunteer website security analyst and website error-hunter)

Announcements