Can't figure out this link injection

[magicjones]

My competitor has dominated the niche with tons of backlinks from URLs that look like this

http://www.pedroniconstruction.com/pedroniconstruction.php?Action=2&k=new-construction-project

There are over 50 of these, I'm assuming injected, listing pages on high ranking legitimate business websites and most of them all have that php?Action=2&k in the URL or end in a number string. Seems to be a mix of different businesses and backlinks on the pages, but always my competitor at the end.

Any ideas what's going on?

 

[lotfiuser]

its seems like a dead site and its wordpress
http://pedroniconstruction.com/pedroniconstruction.php?Action=sitemap

 

[magicjones]

its seems like a dead site and its wordpress
http://pedroniconstruction.com/pedroniconstruction.php?Action=sitemap

Yes I wonder if they are exploiting vulnerabilities in earlier WP versions maybe?
Here are two more examples:

http://www.islandsolarfilms.com/islandsolarfilms.php?Action=2&k=window-film-parksville

http://www.sellmeyerchiropractic.com/sellmeyerchiropractic.php?Action=2&k=st-louis-chiropractor

 

[stack paper]

Outers gonna out.

 

[magicjones]

Outers gonna out.

I just want in

 

[devkareem]

Yes I wonder if they are exploiting vulnerabilities in earlier WP versions maybe?
Here are two more examples:

http://www.islandsolarfilms.com/islandsolarfilms.php?Action=2&k=window-film-parksville

http://www.sellmeyerchiropractic.com/sellmeyerchiropractic.php?Action=2&k=st-louis-chiropractor

This is probably true the pages you listed if u checked at their end all copyright are changed to year 2018. but if you move around the site its actually different they are dead its 2012, 2015 etc. Will debug further when i get on my laptop this is interesting.

 

[devkareem]

This is a start
https://www.exploit-db.com/exploits/22374

They all have the ?action param which wordpress used in earlier versions.

 

[magicjones]

This is probably true the pages you listed if u checked at their end all copyright are changed to year 2018. but if you move around the site its actually different they are dead its 2012, 2015 etc. Will debug further when i get on my laptop this is interesting.

Ahh interesting is the copyright some type of clue? Thanks I guess you may tell it was edited recently...

This is a start
https://www.exploit-db.com/exploits/22374

They all have the ?action param which wordpress used in earlier versions.

Ahh maybe the secret lies in exploiting that action function? Thx

If I google search "php?Action=2&k" it shows many sitemap pages of websites that were injected with these type of business listing pages. Quite the advanced technique.

 

[terrycody]

those are serious black hat experts, no idea what's going on here, but glad black hat is still working...

 

[devkareem]

Ahh interesting is the copyright some type of clue? Thanks I guess you may tell it was edited recently...

Ahh maybe the secret lies in exploiting that action function? Thx

If I google search "php?Action=2&k" it shows many sitemap pages of websites that were injected with these type of business listing pages. Quite the advanced technique.

Mostly yes, i would do that too, i wouldn't want my site to backlink to outdated shitty sites

- http://www.sellmeyerchiropractic.com/sellmeyerchiropractic.php?Action=2&k=st-louis-chiropractor

This site is actually build on HTML. Visit any page its .html except this one. Which means this php file is probably a shell i guess.

Getting on soon to debug it.

 

[magicjones]

Mostly yes, i would do that too, i wouldn't want my site to backlink to outdated shitty sites

- http://www.sellmeyerchiropractic.com/sellmeyerchiropractic.php?Action=2&k=st-louis-chiropractor

This site is actually build on HTML. Visit any page its .html except this one. Which means this php file is probably a shell i guess.

Getting on soon to debug it.

Interesting... I'm starting to think some sort of PHP injection?

those are serious black hat experts, no idea what's going on here, but glad black hat is still working...

Yes and they are crushing the serps with backlinks from these generated listing pages on websites I'm sure don't know they are hosting the pages.
another example:

http://www.doctorgnap.com/doctorgnap.php?Action=2&k=self-help-hypnosis

 

[devkareem]

Can you PM me all the links u got?

i'm online now.

 

[magicjones]

Can you PM me all the links u got?

i'm online now.

I can't figure out how to PM you, maybe I don't have enough rank or something in the forums?

 

[magicjones]

Really powerful one here

https://cadusys.com/cadusys.php?Action=2&k=physicians-answering-service

 

[devkareem]

I can't figure out how to PM you, maybe I don't have enough rank or something in the forums?

Use privnote.com text will expire after i see it

 

[devkareem]

Damn, i'm good. Thank you for sharing this with me i might use it as well lol

I got it, read this 'https://www.wordfence.com/blog/2018...ecurity-release-immediate-update-recommended/'

There is a huge vulnerability in wordpress released recently these folks are exploiting it, view source of the website they are targeting wordpress '5.0.1' which is vulnerable to it.

 

[devkareem]

To whom it may concern Wordpress is facing 7 high-risk vulnerabilities and they are being exploited in the wild. If you are running wordpress i advise you to update everything RIGHT NOW and check your server logs for anything suspicious!

 

[magicjones]

Damn, i'm good. Thank you for sharing this with me i might use it as well lol

I got it, read this 'https://www.wordfence.com/blog/2018...ecurity-release-immediate-update-recommended/'

There is a huge vulnerability in wordpress released recently these folks are exploiting it, view source of the website they are targeting wordpress '5.0.1' which is vulnerable to it.

Awesome!

 

[magicjones]

Good to know also I kept my blog on 4.9

 

[magicjones]

Use privnote.com text will expire after i see it

check out this https://privnote.com/H9GdJ9Dn#bSz367ZHd