I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago that the links to the blog were broken, caused by several of the symlinks involved in our installation being missing; however most if not all of the actual files are intact. I'm fairly certain this was done maliciously, my question is whether there are any Movable Type exploits that could have been used to do this or whether my site has a larger vulnerability that was exploited. The only suspicious files I've found so far are files called "1.do" and "1.php" in one of the movable type directories; both nothing but an empty pair of single quotes. Their modification dates also correspond with the first times I found the blog pages not loading in my Apache access logs.

Anyone know what exploit may have been used and what I can do to prevent it from happening again? I have three load-balanced web servers running CentOS 5.9 and the Movable Type installation was 5.12


There are a large number of known vulnerabilities in MT 5.12, but this one that allows command injection (i.e., anything you can run at the shell, it can do) stands out: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0319

  • Thanks. Any idea how I can tell what commands the attacker managed to execute, like what files were left behind or what URLs were accessed? – joshg Jun 19 '14 at 22:17
  • @joshg save text content, reformat, re-install, upgrade, lest you be by key-logger of Christmas past at midnight – user42209 Aug 19 '14 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.