As an example, he is giving the login of the ech-chaab newspaper’s website, the website is using Joomla CMS, and the guy who posted the logins said he contacted the webmaster 3 times without an answer, so don’t bother yourself doing so.
you can of course add new users (administrators if you want so), and chances that they will never notice this are so high :
also everything is writable, so injecting your own php scripts would never be more easier than this :
of course you have the database credentials and everything under control
What a malicious attacker (I say attacker not a hacker) would do is to add some scripting logic to the existing articles using JavaScript to steal browser history, lunch malwares, spread ads or do what ever he please. more importantly he could inject CSS code in the template to steal visitors browser history and privacy and it will be 100% go unnoticed (yes CSS, look at here ), and it’s useless to mention persistent XSS attacks.
Also, using open source software isn’t the ideal deal always, as discussed by one of the most noticeable folks on web security, whenever you are more obscure, chances you are not going to be chased easily are very high.If after all this you say there is computer science culture in Algeria? then seriously something is wrong with the definition of the Web out there, where newspapers still do not know about web identity, and where computer science institutes do not have internet connection for students.
If you are curious and want to take a look using the logins in the forum, do not forget to get there through a proxy, and this can’t save you neither, so be nice and don’t mess with others’ stuff (unless you are somewhere –like in Algeria- where crimes like these are still considered kind of secondary stuff)
Convince me there is IT in Algeria!
