Sites, using Joomla's built-in Gmail Authentication Plugin, be alert! Your admin or moderator accounts from those sites can be stolean by other members through that plugin. We just found out that, there is a security hole in Joomla 1.5.7's Gmail Authentication Plugin.

Here's the scenario...

Let's say, we have a Joomla site with a super admin called BigBoss and his password is Joomla.

Then we enable Gmail -Authentication Plugin.

Unfortunately, a gmail user, whose account id is also BigBoss (@gmail.com), comes and accesses our Joomla site.

Though, they are having the same IDs, their passwords are different. Let the gmail user's password be Gmail.

Okie... Here comes the interesting part,

What will happen if a user uses ID/PW as BigBoss/Joomla...?

Yah... Simple... He will be authenticated as a super admin.

What if he uses This e-mail address is being protected from spambots. You need JavaScript enabled to view it /Gmail...?

Another straight-forward answer, he will be authenticated as a normal user...

Again, what will happen, if he uses BigBoss/Gmail...?

By right, he should be authenticated as a normal user...

But, in reality, Joomla lets him login as a super admin!!!

Nov 20, 2008: Don't worry! I already fixed the script so that it will correctly detect whether the user is a joomla user or a gmail user.

Please proceed to my tutorial post to find out the solution!