I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from unknown IP addresses:


Yes I am using Composer and have the 'vendor' directory published in my main www directory. Will be moving this to an inaccessible directory right away.

Is anyone aware of a vulnerability/exploit that bots may be trying to find by hitting this specific URL?


Take a look at what that PHP script does:


It's a way to open the door to the DB by adding known usernames and passwords.

  • Hmm. Not really. It has no authentication function and accepts no user-supplied parameters, so it's basically executing a fixed test on a test database (which doesn't exist on my server). Although, I guess if the "account" table existed in a database on your server, and the proper credentials had been supplied to the Test script suite, it could possibly add these users. But since the test_setup.php file doesn't exist, these tests don't have database credentials. – Ryan Griggs Jan 31 at 17:37
  • 2
    But if you had the vanilla install, and had all those test suite artifacts, it would be a way of getting in for free. I'm not saying that the tests will always work, but it's a free and easy way to exploit a poor setup. – schroeder Jan 31 at 17:42
  • 1
    That specific file is safe by itself. Looking at test.php in that same folder, though... If anyone using MeekroDB (not just the person asking this question) ever created test_setup.php with valid credentials, then they need to do a very thorough security audit and tell their users of a potential data breach. – Ghedipunk Jan 31 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.