I get too many of this lately...

Involved Joined: Dec 28, 2003 Posts: 276 Location: Israel

User Agent: Mozilla/4.0
Query String: xxxxxx.com/modules.php?name=Forums&file=viewtopic&t=2813&view=previous&highlight=\'.system(getenv(HTTP_PHP)).\'
Get String: xxxxxx.com/modules.php?name=Forums&file=viewtopic&t=2813&view=previous&highlight=\'.system(getenv(HTTP_PHP)).\'
Post String: xxxxxx.com/modules.php
Forwarded For: none
Client IP: none
Remote Address: 209.67.215.xxx
Remote Port: 51485
Request Method: GET

Any ides what is it all about?!

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Do you have the Santy Worm Protection on in NukeSentinel? If so, try turning it off.

Posted: Sat Jul 30, 2005 4:03 pm

It's already turned off, as I use Site_Messenger which from time to time is detected as abuse-script as well...

Is the above string malicious?

Posted: Sat Jul 30, 2005 4:54 pm

Please supply this part of the email

Code:

Blocked IP: 64.140.49.*


User ID: Anonymous (1)


Reason: Abuse-Harvest


String Match: turnitinbot

Posted: Sat Jul 30, 2005 8:38 pm

Here's the whole mail:

Date & Time: 2005-07-30 16:07:20 EDT GMT -0400
Blocked IP: 209.239.47.138
User ID: Anonymous (1)
Reason: Abuse-Script
--------------------
User Agent: Mozilla/4.0
Query String: xxxxxx.com/modules.php?name=Forums&file=viewtopic&t=2813&view=previous&highlight=\'.system(getenv(HTTP_PHP)).\'
Get String: xxxxxx.com/modules.php?name=Forums&file=viewtopic&t=2813&view=previous&highlight=\'.system(getenv(HTTP_PHP)).\'
Post String: xxxxxx.com/modules.php
Forwarded For: none
Client IP: none
Remote Address: 209.239.47.138
Remote Port: 55304
Request Method: GET

Posted: Sat Jul 30, 2005 8:46 pm

It's being flagged because of the singe quote marks. That's how javascript and other things can be injected.

Posted: Sun Jul 31, 2005 12:33 am

2 questions:
A. Is the original string I've pasted here should be treated as malicious?
B. Re. Site_Messenger - indeed, charcters like " ( ) Sentinel set the alarm abuse-script on. anyway to allow such charcters?

Posted: Wed Aug 03, 2005 4:57 am

Well, no question? Raven?!

Posted: Wed Aug 03, 2005 6:31 am

#1 - Yes, it is malicious
#2 - Even if NukeSentinel was turned off, mainfile.php would flag the same charatcers.

See also http://www.ravenphpscripts.com/postx6264-0-0.html