Welcome to Geeklog, Anonymous Sunday, October 06 2024 @ 04:30 pm EDT

Comments for So-called Geeklog "exploit" posted

So-called Geeklog "exploit" posted | 9 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

So-called Geeklog "exploit" posted

Authored by: Dirk on Sunday, October 21 2007 @ 04:22 pm EDT

Well, if you don't have anything in your webroot that shouldn't be there, then you won't have this problem anyway. The above issue mostly affects sites that used installers like Fantastico (and, in retrospect, I had no idea how widespread its usage was when I wrote the that article).

bye, Dirk

So-called Geeklog "exploit" posted

Authored by: AA6QN on Monday, October 22 2007 @ 07:44 am EDT

Thank you, Just for grins, my logwatch reports daily attempts:

Requests with error response codes
403 Forbidden
//plugins/spamx/BlackList.Examine.class.ph ... host.com/safe3?: 2 Time(s)
/forum//plugins/spamx/BlackList.Examine.cl ... host.com/safe3?: 2 Time(s)
/plugins/links/functions.inc?_CONF[path]=h ... el.es/safe.gif?: 1 Time(s)
/plugins/spamx/DeleteComment.Action.class. ... 00/cmdhtml.txt?: 2 Time(s)
/plugins/spamx/MassDelete.Admin.class.php? ... el.es/safe.gif?: 1 Time(s)

The offending IP will end up in a ipblock statement on a firewall. No Snort signatures for this yet. I am glad you did write the article as it gave deffinintion as to what was going on.
Thank you once again, JohnF

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks