Recover content and access from an old Joomla 1.5 site

Notice: archived document. Joomla 1.5 stopped receiving support and security fixes years ago. It must not be left exposed to the internet or used for a production site.

The old technique of writing a known MD5 hash into the database has been withdrawn. It created a universal, predictable and reusable credential that could leave the installation open to anyone who knew the procedure.

Safe course of action

• Isolate the installation from the public network and keep a full backup of files and the database before doing anything.
• Recover the content in a temporary, restricted environment. If you need administrative access, use a method specific to that installation, supervised by a professional and with a unique password generated for the occasion; there is no safe universal password.
• Rotate the administrators' credentials and any access that was reused, exposed during the recovery or involved in an intrusion. There is no need to change unrelated accounts without evidence of exposure.
• Migrate the content, the accounts you need and the valid configuration to a supported version of Joomla, testing it first on a staging environment.

Do not republish Joomla 1.5 as a way of recovering access. The recovery should only serve to extract and migrate the data.

What to prepare to recover the content

Identify the installation, its database and the table prefix from configuration.php, without publishing that file or its credentials. Keep the files, images and a database export together: downloading only the visible pages can leave out content and internal relationships.

In the restricted environment, check the articles, categories, menus, users and extensions involved in the content. The goal is to decide what needs moving and which features need a maintained replacement; recovering an administrator session does not fix the version's vulnerabilities.

If your site uses a different version of Joomla, do not apply procedures specific to 1.5. Confirm the version before touching tables or authentication plugins. The official Joomla 1.5 version history identifies this branch as unsupported; its recommendations of old versions should not be read as a current migration target either.