Please Check!!

[dePaulus]

Hi.
Don't really know where to post this, but about 4 days ago I started getting a wave of traffic, and they all used the folowing google querie..

" inurl:top_rated.php + indexu "

Now I know this ( dork) usually means that somewhere a vunerability issue has been posted on the boards, and the kiddies are using the "dork" to find the script, in this case IndexU..

I have had a handful of people register "porn sites" and "pharma's" as far as I can see no damage done, i deleted the accounts.. some also came from here..
http://www.abnobis.com/webmaster/admin_login.php

I don't know much about this, but hopefully someone can look into this, and see what the deal is??

Thanks

de P

[FSGDAG]

Doing a Google search of this turns up that there was a vulnerability in version 5.0 and 5.1. If your using the latest version, I dont think this will be an issue for you.

Maybe people are still looking for old versions of the script out there.

[Bruceper]

inurl:top_rated.php <-searches for any file "in" the URL, which means *.*/top_rated.php

+ <- pretty obvious

indexu <- must contain the word "indexu" ie "powered by indexu"

This is a WAY old exploit for version 5.00 and 5.01

See http://securitytracker.com/alerts/2006/Apr/1015891.html

[Bruceper]

As a followup, please note that FSGDAG is incorrect in his version, 5.1 was NOT vulnerable, 5.01 is.

Also note that this is still a popular exploit because the loser warez kiddies still keep using 5.01 because they're too cheap to pay for it and too dumb to patch it.

[dePaulus]

Thank you for clearing this, I feel alot better now that it is an old exploit,
Stange that it suddenly popped up again, the article must have been re-published again.. Romania, going buy the traffic I'm getting..

Thanks Again for clearing it up.

de P.

[FSGDAG]

As a followup, please note that FSGDAG is incorrect in his version, 5.1 was NOT vulnerable, 5.01 is.

I must have missed the "0" when I was typing it out.

[Bruceper]

Not a problem, I just didn't want people to see the thread and panic