Good (related) read about this vulnerability by the Trustwave team:

https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-S...