Search This Blog

06 December 2007

Vulnerable PHP application?

I seem to be getting a lot of requests on my webserver of the form: "GET /<directory-path>/pmapper-3.2-beta3/incphp/globals.php?__SESSION[PM_INCPHP]=<some-url>?" where replace the <directory-path> and the <some-url> with a path on your server and some random website respectively. It appears to be a probe to test for some vulnerability but I don't have the full request logged, only the request up to the question mark on the GET request so the payload isn't logged. The changing URLs are probably to throw people off the scent.

I must confess, I had no idea what this "pmapperr" application was before I observed these hits and nor do I have PHP installed on my webserver but I figure if I mention it on this blog, an audience who may be able to investigate can do something.

Oh well, I have done my part.

30 November 2007

Stuff since the last update

The Thanksgiving break was a welcome change of pace... and on the idle driving up and down the Californian coastline, I had a few moments to work on the MySQL External Stored Procedures project. I think I pretty much have Perl functioning fully and a couple of minor problems were resolved.
Yesterday, I completed the first draft of the all-revised-from-scratch WL#3771, now titled as the Plugable Audit Interface. Moving on to my other worklog task - Falcon on big-endian architectures, again, from scratch.