Geeklog Forums

Addendum to following:

On further looking at my system, I'm of the opinion that the "zlq.php" file used in this attack may have been left over from May some time when it was put on the system via the older version of Media Gallery. In any case, this attack should serve as an example to others to check their maint sub directory for files that may have been put there prior to update to the later versions. The rest of the files in that directory are date stamped June 24 where the zlq.php was May 15.

It appears that someone "out there" is searching Google or other engines for evidence of the compromised files - or already knows they are there - or is just fishing for them on all sites. Be warned!
------------ end of addendum -------------

I don't see any info on an attack to this version of MG on Geeklog but on Oct 10 one of my installations was compromised by adding a link to the footer.thtml file in the default layout. I have the log entries and they are similar to what appears to be an attempt back on My 15 to use the previous problem noted here http://www.geeklog.net/article.php/20070515095353878



Note the "censored" is because your badwords setting needs a space somewhere around bad particle in the word h a n c o c k as this is a legitimate web site with video and discussion from wildlife cameras.

I have the rest of the log entries for this attack - please contact me at richard@pacdat.net for details. In the mean time I'd suggest setting your layout files to read only including the directory above them.

Richard,

I've sent you an email requesting the logs.

From the part you quoted, it definitely looks there is a new file in the mediagallery/maint/ directory, zlq.php. That file is not part of Media Gallery. It is obviously a file that allows someone to remotely edit your web based files.

We need to determine how that file made it to your system, whether it was via a issue with Media Gallery, Geeklog, PHP, etc.

As many of the logs files as you have would be beneficial.

Thanks!
Mark