I just had to solve a spamming issue on a shared hosting server, where a Joomla 1.5 (time to upgrade, eh?!) was hacked and used to upload several files, one of them a cgi web shell:
The interesting thing is, that this file extension doesn't end in ".cgi" or ".php", which makes it more difficult to automatic search mechanisms, which for example search for uploaded php files, to discover the file.
The hacker uploaded a .htaccess file into the cgiweb folder, declaring that the file extension ".root" should be used as cgi-script through AddHandler definition.
When the correct password was given, shell commands could be executed in the web shell, for example uname:
How to solve this? Well, a temporary solution is to delete the uploaded files and folders. But as old and end of life Joomla versions are and will stay vulnerable, the only real solution is that this web-customer upgrades his Joomla CMS.