JacekN

Thanks, Kicken. Nothing better than a framework that opens up holes.

Thanks, Max. What about this one? uri=/index.php?s=/Index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=sha1&vars[1][]=xyzt

But what kind of vulnerability? I run my own php script, so I'm not concerned about exposure. I just want to know what they're after. It this a WordPress exploit or something like that?

When someone sends this to your index.php, what are they trying to do? /index.php?s=/module/action/param1/${@die(sha1(xyzt))}