welches einfach in die betroffenen Dateien inkludiert werden kann und dann sowohl den Querystring, als auch die Post-Variablen auf verdächtige Strings überprüft.
Die betroffenen Dateien sind:
/contenido/backend_search.php
/contenido/classes/class.inuse.php
/contenido/classes/class.htmlelements.php
/contenido/cronjobs/move_articles.php
/contenido/cronjobs/move_old_stats.php
/contenido/cronjobs/optimize_database.php
/contenido/cronjobs/run_newsletter_job.php
/contenido/cronjobs/send_reminder.php
/contenido/cronjobs/session_cleanup.php
/contenido/cronjobs/setfrontenduserstate.php
/contenido/includes/include.logs.php
/contenido/includes/include.con_subnav.php
/contenido/includes/include.grouprights_subnav.php
/contenido/includes/include.right_top_blank.php
/contenido/includes/include.rights_subnav.php
/contenido/includes/include.subnav.php
/contenido/includes/include.tpl_subnav.php
/contenido/includes/include.newsletter_jobs_subnav.php
/contenido/plugins/content_allocation/includes/include.right_top.php
/contenido/external/frontend/news.php
Ich habe hier alle mir bekannten Dateien aufgelistet.
Je nach Contendio-Version kann es vorkommen, dass Dateien nicht existieren - also nicht wundern
Hier das Script, welches als ic.php im Root-Verzeichnis eurer Domain abgelegt werden muss:
Code: Alles auswählen
<?PHP
/********************************************
* sangrio injectionCheck 1.3 [20080801]
* Mirco Schmidt | mirco@sangrio.de
* http://www.sangrio.de/ic/
*********************************************/
function ic()
{
$strings = array("http","ftp","telnet","request","file","mail","script","javascript","cfg","config","inc","cd","wget","fopen","fwrite","get","insert","include","require","passwd","password","rm","rmdir","mkdir","chmod","chown","vi","kill","reboot","reload","halt","stop","getenv","etc","bin","www","root","txt","cgi","pl","eml","js","css","jsp","sql","mysql","into","select","cc","bcc","apparently-to","boundary","charset","content-type","content-transfer-encoding","errors-to","reply","message","mime","multipart");
if($_SERVER['QUERY_STRING']) { foreach($strings as $var) { if(strstr($_SERVER['QUERY_STRING'],$var)) { $attempt = 1; } } }
if($_POST) { foreach($strings as $var) { foreach($_POST as $key=>$value) { if(strstr($key,$var) || strstr($value,$var)) { $attempt = 1; } } } }
if($attempt)
{
header("Location: http://" . $_SERVER['HTTP_HOST']);
die();
}
}
ic();
?>
Um die betroffenen Dateien mit dem Script zu schützen, einfach diesen
Code am Anfang aller oben aufgeführten Dateien einfügen:
Code: Alles auswählen
include($_SERVER["DOCUMENT_ROOT"] . "/ic.php");
Sonnige Grüße von der Ostsee,
Mirco