Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code.

I am pretty confident that this is trying to make use of some php vulnerability or other. So, I am curious:

  1. What vulnerability is this trying to make use of?
  2. How does one protect against this vulnerability?
  3. What in the site configuration would be changed if this vulnerability was successfully exploited?
share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Looks like they're trying to do a remote file include attack. Looks like this is the vulnerability they are trying to exploit but I'm not 100% sure of it. I'm guessing you look safe if you're not using that application and/or have register_globals turned off (which you always should).

share|improve this answer
    
The server it's hitting isn't even a php site, so I'm definitely safe. I'm just wondering about it for other sites I have that do use php. –  Brian Jan 24 '11 at 20:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.