I noticed multiple hits per day on get.php in the access logs of a Magento 1.14 store, resulting in PHP errors and a HTTP 500 response.

Some of them have bot user agents like facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php) or Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm), some come from Outlook and most do not have a user agent at all, but often from the same few IP addresses at the same time of day.

Is there a logical explanation for that other than somebody is trying to gather information or exploit security holes in get.php? We never used the feature to store images in the database, so there is no legit usage for this script.

I reckon, it is safer to delete the file to eliminate a possible attack vector, but first I'd like to understand what could be going on there. Any ideas?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.