Re: help needed

[Heilig Szabolcs <debian-reader@phphost.hu>]

Hello!

> http://jesusch.de/~jesusch/tmp/access.log

There are many log entries with "something=http://"; style
pattern. These are common attack methods against default configured
servers with poorly written applications. Many of these rely on
register_globals=on php.ini setting. Turn it off first globally.
This may break some old PHP apps, but you can turn it back on
in virtualhosts locally.

> at that mentioned time someone at least tried to access pages which are 
> not accessable (index.php?img=1 e.g.)
>
> ther definately might be a problem in the code:
>
> if ( $_GET['page'] ) {
>         include $_GET['page'].'/index.php';
> }

Yes, that code is very dangerous. Vulnerable,
whether you turn off register_globals or not.
It uses $_GET['page'] variable without checking
its content.

Attackers successfully included that code for example:
http://home.comcast.net/~mr-meeks/r57.txt

My suggestion: turn allow_url_fopen off globbaly
in php.ini too. One small step to security with
minimal loss of functionality...

--
Szabolcs heilig
cece@phphost.hu