MyCity » Web programiranje -> PHP » PHP propust ili nesiguran web server?

PHP propust ili nesiguran web server?

Napisano na dan: 2.10.2008

PHP propust ili nesiguran web server?
Sledeća strana Pagination

Idi na vrh

Poslao: 02 Okt 2008 17:15
Idi na vrh
offline
  • Pridružio: 28 Apr 2005
  • Poruke: 3686
  • Gde živiš: The Circle

Ovo ludilo se s vremena na vreme pojavi u footer-u stranice, medjutim posto se insertuje iza zavrsnog </html> taga ne vidi se na sajtu osim u source code-u Smile

Ovo je spam koji biva insertovan:

<SCRIPT LANGUAGE="JavaScript"> <!-- function stat() {document.getElementById('123').style.display = "none";} //--> </SCRIPT> <div name=123 id="123"><A HREF="http://graphics.gr/pages/fpages/buy-cialis.html">buy cialis</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/arimidex.html">arimidex</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/zelnorm.html">zelnorm</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/clomid.html">clomid</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/emsam.html">emsam</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/zestril.html">zestril</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/clomid-sucess-stories.html">clomid sucess stories</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/lasix.html">lasix</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/nutrition-hgh.html">nutrition hgh</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/cialis-no-prescription.html">cialis no prescription</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/triphala.html">triphala</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/zantac.html">zantac</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/nexium-side-effects.html">nexium side effects</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/oral-hgh.html">oral hgh</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/generic-levitra.html">generic levitra</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/aleve.html">aleve</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/natural-breast-enhancement.html">natural breast enhancement</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/toprol-xl.html">toprol xl</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/accutane-acne-treatment.html">accutane acne treatment</A>&nbsp;|&nbsp;<A HREF="http://graphics.gr/pages/fpages/pravachol.html">pravachol</A></div> <SCRIPT LANGUAGE="JavaScript"> <!-- stat(); //--> </SCRIPT> <SCRIPT LANGUAGE="JavaScript"> <!-- function stat() {document.getElementById('1234').style.display = "none";} //--> </SCRIPT> <div name=1234 id="1234"><A HREF="http://leithhistory.co.uk/maps/pages/sitemap56.html">free xxx long movies</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap66.html">nude teen links</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap51.html">teen cocksuckers</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap6.html">hardcore anal sex</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap53.html">how to train your dog to lick pussy</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap70.html">cheergirlsgallery</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap49.html">ukranian virgins</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap52.html">bdsm paddles</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap1.html">kiss lesbian teen</A>&nbsp;|&nbsp;<A HREF="http://leithhistory.co.uk/maps/pages/sitemap32.html">whore</A></div> <SCRIPT LANGUAGE="JavaScript"> <!-- stat(); //--> </SCRIPT> <SCRIPT LANGUAGE="JavaScript"> <!-- function stat() {document.getElementById('12345').style.display = "none";} //--> </SCRIPT> <div name=12345 id="12345"><A HREF="http://globalsolutions.org/modules/mod/generic-nexium.html">generic nexium</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/nexium-iv-drip-protocol.html">nexium iv drip protocol</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/ziac-and-nexium-drug-interaction.html">ziac and nexium drug interaction</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/nexium-gastrectomy.html">nexium gastrectomy</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/nexium-and-joint-pain.html">nexium and joint pain</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/nexium-iv-stability.html">nexium iv stability</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/nexium-side-effect.html">nexium side effect</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/can-you-wean-your-body-of-nexium.html">can you wean your body of nexium</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/how-to-wean-off-nexium.html">how to wean off nexium</A>&nbsp;|&nbsp;<A HREF="http://globalsolutions.org/modules/mod/nexium-and-hypocalcemia.html">nexium and hypocalcemia</A></div> <SCRIPT LANGUAGE="JavaScript"> <!-- stat(); //--> </SCRIPT>

Dakle tipican spam sa mnogo linkova ka viagri i ostalim cudesima.

A ovo je kod index stranice:

<?php include "str/header.php"; //ukljucivanje headera switch ($izbor) { case "home": include"strane/home.php";      break; case "kontakt": include"strane/kontakt.php";    break; .... jos case-ova.......  default:  include"strane/home.php";   } include "str/footer.php"; //ukljucivanje footera ?> 

S obzirom da se javlja i na ostalim sajtovima koji se hostuju na istom serveru, a koji su staticki html sajtovi onda ce ipak biti problem (ne)sigurnost web servera...

Komentar?



Registruj se da bi učestvovao u diskusiji. Registrovanim korisnicima se NE prikazuju reklame unutar poruka.
Poslao: 03 Okt 2008 01:36
Idi na vrh
offline
  • igor86  Male
  • Stručni saradnik
    Web programiranje
  • Pridružio: 24 Maj 2006
  • Poruke: 1633

Nesto tu meni debelo smrdi, prije mislim da ti pokupio neki virus. Daj URL, sumnjam da je u pitanju ovo gore sto si naveo.



Poslao: 03 Okt 2008 11:31
Idi na vrh
offline
  • Pridružio: 28 Apr 2005
  • Poruke: 3686
  • Gde živiš: The Circle

To je i meni palo na pamet, da kolega koji azurira sajt preko svog FTP klijenta nakaci neki shit Confused

Uglavnom nema svrhe URL sada kada sam ocistio Smile

Najbitnije da nije PHP propust. SQL injection ne moze da bude jer ta stranica nema veze sa bazom, samo par drugih stranica na kojima ni nema problema.

Poslao: 14 Dec 2008 23:30
Idi na vrh
offline
  • Pridružio: 14 Dec 2008
  • Poruke: 3

Da .... problem je do provajdera.
Imao sam slican (isti) problem pre mesec dana kada sam video da su se na trenutak pojavili linkovi na index strani pa nestali. Pojavili su se zato sto mi je internet u tom trenutku bio jako spor, u suprotnom ne bih ni video to.

U sam html su bili ubaceni hidden linkovi ka vij^agri i ostalim stvarima i to bas poveca gomila Smile bilo je preko 200 - 300 linkova.

40 strana koliko ima sajt, na 20 je bio ubacen kod, a njih 8 nije uopste radilo, bilo je sve obrisano.
Te strane gde je bio ubacen reklamni kod radile su normalno.....

Zvao sam provajdera i oni su potvrdili da su bili izlozeni napadima i da nisam jedini Smile

Sta reci posle ovoga .....

MyCity » Web programiranje -> PHP » PHP propust ili nesiguran web server?

Ko je trenutno na forumu
 

Ukupno su 1476 korisnika na forumu :: 120 registrovanih, 7 sakrivenih i 1349 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 015, _Sale, Acivi, amaterSRB, Andrija 1993, ArchaBasha, Asteker, bato_banjaluka, blackjack, Bobrock1, boj.an, bojan_t, Boris90, Carl Gustaf, ccoogg123, celeron, Cian, colji, Crazzer, dacanaldo, DalmatinacMF, dankisha, darkangel, darkojovxp, david47, dearg, Dekster, Denaya, Django777, Djole3621, djukapfc, dovlafkcz, dragan_mig31, DrSidious, Duh sa sekirom, feanor, FileFinder, Flotikius, g_g, gorankuba, grunff2, HrcAk47, Insan, ivicasimo, jalos, Joja, Josef, Klass, Kordon, Krusarac, lcc, lucko1, Marko Marković, MB120mm, Metanoja, Mi lao shu, mikidragi, mikrimaus, Milometer, milutin134, mir, MiroslavD, mix1, Mmipko, mrav pesadinac, mux, Najax, neko iz mase, nenad81, nenooo, nsharambasa, oganj123, operniki, orah, OtacMakarije, Panzer88, Phalanx, Plavi Jadran, Polemarchoi, precan, Profica, proka89, promajauglavi, radionica1, raf87, raketaš, redstar011, samo opusteno, SamostalniReferent, Shadow soldier, Shilok, shota91, sickmouse, Sky diver 29, ss10, Steeeefan, strela, Szigetwar, tanakadzo, Tas011, Tihi86, trademark1982, Troja, uruk, vathra, veljkovicdani, vensla, Viktor Petrenko, Vlada1389, vojnik švejk, Wrangler, XBMC, zeo, Zimbabwe, ZlatniRez, Zvrk, šumar bk2, Ćuk, 787, 800077