I noticed multiple hits per day on
get.php in the access logs of a Magento 1.14 store, resulting in PHP errors and a HTTP 500 response.
Some of them have bot user agents like
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php) or
Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm), some come from Outlook and most do not have a user agent at all, but often from the same few IP addresses at the same time of day.
Is there a logical explanation for that other than somebody is trying to gather information or exploit security holes in
get.php? We never used the feature to store images in the database, so there is no legit usage for this script.
I reckon, it is safer to delete the file to eliminate a possible attack vector, but first I'd like to understand what could be going on there. Any ideas?