1

I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code.

I am pretty confident that this is trying to make use of some php vulnerability or other. So, I am curious:

  1. What vulnerability is this trying to make use of?
  2. How does one protect against this vulnerability?
  3. What in the site configuration would be changed if this vulnerability was successfully exploited?
Improve this question

1 Answer 1

Reset to default
1

Looks like they're trying to do a remote file include attack. Looks like this is the vulnerability they are trying to exploit but I'm not 100% sure of it. I'm guessing you look safe if you're not using that application and/or have register_globals turned off (which you always should).

Improve this answer
1
  • The server it's hitting isn't even a php site, so I'm definitely safe. I'm just wondering about it for other sites I have that do use php.
    – Brian
    Commented Jan 24, 2011 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.