Re: evil script in server logs (Heads Up)
| From: | Daniel Brown | Date: | Fri, 05 Oct 2007 15:46:33 +0000 |
| Subject: | Re: evil script in server logs (Heads Up) | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-262820@lists.php.net to get a copy of this message | ||
On 10/5/07, Paul Scott <pscott@uwc.ac.za> wrote:
>
> On Fri, 2007-10-05 at 11:29 -0400, Daniel Brown wrote:
> > Yeah, honestly I wasn't sure if it was an injection attack or if
> > those URLs were referrers in the logs.
>
> OK sorry if I wasn't 100% clear here, but the logs showed up something
> like:
>
> S
> stq5NELhttp://fsiu.uwc.ac.za/index.php?module=http://www.goodasgold.com/nav
>
> So basically it was an XSS attempt, but because our MVC security is
> decent, it is just more of an annoyance than anything else (it screws up
> my stats man!)
>
> What I was trying to say is that *if* you didn't know about this one
> before, now you do. They are hitting all of our sites at a rate of
> knots, so are probably doing the same elsewhere.
>
> --Paul
>
>
> All Email originating from UWC is covered by disclaimer
> http://www.uwc.ac.za/portal/uwc2006/content/mail_disclaimer/index.htm
>
>
Sounds like a Joomla exploit attempt. Either way, thanks for the
heads-up, Paul.
--
Daniel P. Brown
[office] (570-) 587-7080 Ext. 272
[mobile] (570-) 766-8107
Give a man a fish, he'll eat for a day. Then you'll find out he was
allergic and is hospitalized. See? No good deed goes unpunished....