Uploaded malicious code

dev google-group-archive
1

Hi,

My anti-virus scanner found some snippets of malicious code in the
lucee\temp directory (files tmp-1.upload etc). The code are little php
snippets, and they are not published anywhere (hence sitting in the temp
folder). But where can I find from where they were uploaded - I thought I
had no (public) pages/templates on this server that allowed uploads.

Is this in any log file anywhere?

Med vänlig hälsning,
Hugo–
Hugo Ahlenius
@Hugo_Ahlenius

2

Check the timestamps they were created and cross reference your web server
access logs?

~BradOn Thursday, August 4, 2016 at 1:58:01 AM UTC-5, Hugo Ahlenius wrote:

Hi,

My anti-virus scanner found some snippets of malicious code in the
lucee\temp directory (files tmp-1.upload etc). The code are little php
snippets, and they are not published anywhere (hence sitting in the temp
folder). But where can I find from where they were uploaded - I thought I
had no (public) pages/templates on this server that allowed uploads.

Is this in any log file anywhere?

Med vänlig hälsning,
Hugo

–
Hugo Ahlenius
@Hugo_Ahlenius

3

just a wild guess, are perhaps file attachments being automatically saved
to temp?On Thu, Aug 4, 2016 at 8:56 AM, Hugo Ahlenius <@Hugo_Ahlenius> wrote:

Hi,

My anti-virus scanner found some snippets of malicious code in the
lucee\temp directory (files tmp-1.upload etc). The code are little php
snippets, and they are not published anywhere (hence sitting in the temp
folder). But where can I find from where they were uploaded - I thought I
had no (public) pages/templates on this server that allowed uploads.

Is this in any log file anywhere?

Med vänlig hälsning,
Hugo

–
Hugo Ahlenius
@Hugo_Ahlenius

–
Get 10% off of the regular price for this years CFCamp in Munich, Germany
(Oct. 20th & 21st) with the Lucee discount code Lucee@cfcamp. 189€
instead of 210€. Visit https://ti.to/cfcamp/cfcamp-
2016/discount/Lucee@cfcamp

You received this message because you are subscribed to the Google Groups
“Lucee” group.
To unsubscribe from this group and stop receiving emails from it, send an
email to lucee+unsubscribe@googlegroups.com.
To post to this group, send email to lucee@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/lucee/0a0901d1ee1d%2454c69de0%24fe53d9a0%24%40oxel.net.
For more options, visit https://groups.google.com/d/optout.

–
Zac Spitzer
+61 405 847 168