Today, two of my sites (evo 1.0.1 and evo 1.0.2)(on two different server), received a lot of simultaneous request from the same ip (64.191.14.213), causing sqlserver to run at 100% CPU and bring down the server..
all request , on both sites, calls the same page:
tags.html?tags=&start=220&amp
or
tags.html?tags=&start=220&start=1
tags.html?tags=&start=220&start=2
tags.html?tags=&start=220&start=3
tags.html?tags=&start=220&start=4
Is it an Hacking Attempt??
Update:
same on another site/server (0.9.6x)
-
MODX Staff
- 10,725 Posts
What is on your tags.html page?
it’s a
ditto page with call for
tvtagcloud snippet, used to create tv tags categories (something like old modx repository).
I’ve banned ip 64.191.14.213 in the .htaccess file
some info about it:
http://www.projecthoneypot.org/ip_64.191.14.213
....in latest two months i’ve found more similiar attempts to Hacking modx websites.
I’m not a coder or a security expert, but seems very similiar to the "
Exploit 0day" DOS found by Emanuale Gentili (BackTrack and Joomla security team) in Joomla, WordPress, Drupal and other CMS.
http://www.hack0wn.com/view.php?xroot=6.0&cat=exploits
http://core.trac.wordpress.org/ticket/11685
https://irclogs.wordpress.org/chanlog.php?channel=wordpress-dev&day=2009-12-31&sort=asc
