Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code.

I am pretty confident that this is trying to make use of some php vulnerability or other. So, I am curious:

  1. What vulnerability is this trying to make use of?
  2. How does one protect against this vulnerability?
  3. What in the site configuration would be changed if this vulnerability was successfully exploited?
share|improve this question
up vote 1 down vote accepted

Looks like they're trying to do a remote file include attack. Looks like this is the vulnerability they are trying to exploit but I'm not 100% sure of it. I'm guessing you look safe if you're not using that application and/or have register_globals turned off (which you always should).

share|improve this answer
The server it's hitting isn't even a php site, so I'm definitely safe. I'm just wondering about it for other sites I have that do use php. – Brian Jan 24 '11 at 20:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.