I have incoming traffic from searches for "powered by s9y", heading straight over to [path]/htmlarea/plugins/ExtendedFileManager/manager.php - better apply those patches everyone.
I actually had my system compromised as a result of this exploit. It occurred on 11/24. I tied it together when i found out about this exploit. The system has already been wiped and rebuilt. I have log data if anyone is interested.
Markus Hansen am um :
I have incoming traffic from searches for "powered by s9y", heading straight over to [path]/htmlarea/plugins/ExtendedFileManager/manager.php - better apply those patches everyone.
Alan Kennington am um :
Yes, I had exactly the same thing. First there was a search for in Netherlands Google from an HTTP client IP address which is apparently in Latvia.
http://www.google.nl/search?q=Powered+by+s9y&hl=nl&client=firefox-a&hs=B8P&rls=org.mozilla:en-US:official&prmd=ivnsfd&ei=BAYSTazvE8mSOrjozaoJ&start=100&sa=N
Then they made a jump directly to htmlarea/plugins/ExtendedFileManager/manager.php.
Gangrif am um :
I actually had my system compromised as a result of this exploit. It occurred on 11/24. I tied it together when i found out about this exploit. The system has already been wiped and rebuilt. I have log data if anyone is interested.
F. Leven am um :
My site was hacked and files are uploaded to (jpg/txt/php) :
htmlarea/plugins/BackgroundImage/backgrounds/thumbnails
all index sites are changed and some php lines are inserted. i can mail the changes if someones is interested
macdet am um :
@F. Leven - please send!
I am under work :) seems time to look for an upgrade!
lte am um :
great! Looking forward :)