Re: [Phpwiki-talk] Known attacks against PhpWiki wikis?

[Reini U. <ru...@x-...>]

Robert Dodier schrieb:
> I have another question about security. Have there been any known
> attacks against PhpWiki wikis? Excluding vandalism of pages. Has 
> it ever happened that someone successfully obtained a database
> password and (1) really messed up the wiki -- e.g., in such a way
> that it couldn't be reloaded from an archive, or 
> (2) got access to stuff other than the wiki content?

the sceptical party is wrong.
1) I know of no phpwiki abuse so far, but other wikis had been 
reportedly abused. but not massively and not that they couldn't be 
restored from the daily database backup.
the typical wiki abuse is not via the db directly (db password and host 
security abuse), it is done by writing a short script which does the 
necessary POST requests to the system.
it makes no sense and is typically deleted by the next visitor or by the 
admin, whoever detects first.
we have no such robot detection code yet included, because then we have 
to analyse the sessions, store the visitor IP and timestamp. but I once 
had some code to prevent from abusive robots, which got caught in a 
loop. now it is not needed anymore.
ward's wiki has such code included, which was needed then.

2) not to my knowledge. but every system intruder has access to 
everything else than the wiki content. and there are dozens of 
intrusions worldwide per day.

> Sorry to ask so many questions -- I am trying to convince a 
> skeptical third party that it's safe to run PhpWiki. Thanks for
> your help. I appreciate it very much.

the sceptical party is right. it's not safe to run phpwiki such it is 
not safe to run any service which is accessible to the world, such as a 
webserver, fileserver or mail server.
-- 
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/