Another Hacker on plusnets servers.

[#1]

here we go .. got another one.

User Anonymous has been automatically banned on your site PlanetQuakeWar
Cause: Breach attempt on file admin.php or attempted to use SQL exploit<br>Url 
String: /index.php?page=../../../../../../../../../../../../../../../etc/passwd <br>
Url: legacy-moh2.ptn-games07.games.plus.net<br>Banned Ip is 87.114.10.119<br>
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)<br>

check out that domain for scripts please admins.
having a website hacked is bad enough, worse again when it comes from inside the network.
[Moderator's note by billbo: Code broken up it was way too wide]

[#2]

You do have to be careful as this may just be a member of a botnet, and not necessarily direct malicious behaviour.
However, that being said I'm sure Plusnet will investigate as far as they can.
B.

[#3]

abuse@plus.net is their email, according to Domain-Tools: http://whois.domaintools.com/87.114.10.119

[#4]

Its very unlikely to be a PlusNet customer, as any account with shell access to the cgi servers can read that file, all 8713 lines of it.
Also they only need to go back three directories.
Chilly

[#5]

Quote from: chillypenguin

Its very unlikely to be a PlusNet customer

Quote

Banned Ip is 87.114.10.119

C:\Documents and Settings\John>nslookup 87.114.10.119
Server:  localhost
Address:  127.0.0.1
Name:    87.114.10.119.plusnet.thn-ag3.dyn.plus.net
Address:  87.114.10.119

[#6]

I was not saying that the address was not PlusNet. Just that any user could get that file much easier.
I was thinking along the lines of a bot, or machine that has been hacked itself.
Chilly

[#7]

We would be very grateful if this report could be submitted via the correct procedure, as per:
http://www.plus.net/support/security/abuse/how_to_report_abuse.shtml
Many thanks,
Ian
(Just fixing your link, Ian)