WORM: PHPInclude.Worm Remote Exploitation

This signature detects attempts by the PHPInclude Worm (or variants) to propagate by exploiting a vulnerable remote PHP script. The worm can supply a remote PHP script with variables that point to malicious PHP code on a remote server, effectively directing the target to infect itself with a copy of the worm.

Extended Description

PhpInclude.Worm is a worm that infects PHP web pages. It installs IRC robots on an affected server.

References

URL: http://www.k-otik.com/exploits/20041225.PhpIncludeWorm.php

Short Name

WORM:PHPINCLUDE:EXPLOIT

Severity

Major

Recommended

False

Recommended Action

Drop

WORM: PHPInclude.Worm Remote Exploitation

Extended Description

References

Found a potential security threat?