admin area visible to crawlers

I just wanted to let you guys know the admin directory is visible to crawlers on 1.3.9g... I know this isnt the newest version and I havent tested newer version but using an SEO crawler at seomoz.org I can see the directory via the contact us form.

Just in case this has been overlooked for awhile I wanted to put it out.

-Jason

The only way that can happen is if the site was hacked and a shell script was left behind. You will need to clean this up.

There's one other way that a crawler could discover the URL to your admin area: that's ONLY if you told it where it is. ... either by listing it in your /robots.txt file, or by putting a link to it someplace on your site.

As far as the crawler being able to access links INSIDE your admin, that's only possible if you (or a hacker) have done something that's added a vulnerability to let them bypass the login requirements.

But, as qdixon has said, you've most likely been hacked and need to do a thorough cleanup.

here is a copy of my robots.txt

User-agent: *
Disallow: /cgi-bin/
Disallow: /*zenid=
Disallow: /conditions
Disallow: /terms-conditions-page-9
Disallow: /WGAW/
Disallow: /tell_a_friend/
Disallow: /dpu_ajax.php
Allow: /

To my knowledge my site hasn't been hacked. How can I verify if a shell script was left behind?

here is the link the crawler finds (as a 404 error)

/adminarea/%3C?php%20echo%20zen_href_link(FILENAME_CONTACT_US);%20?>

adminarea is not the name of my admin area.

Just to be clear the crawler isn't crawling the admin directory. It just finds a 404 error link as listed above.

However the possibility of a vulnerability does worry me, I will be reading through the security forum and verifying my security practices.

Also the url listed above is to the secure (https) portion of my site.

Send me a PM with your website address and I will have a look.

So, you're saying that you're seeing a 404 error reported in your search engine's error log.
And it just so happens to be mentioning a non-existent folder that just so happens to be called "adminarea".

That's an entirely different thing from the actual "admin area [being] visible to crawlers".

It probably picked up the link from some spam site and tried to visit it, and properly got the 404 error. In that case, it's nothing to worry about.
You might want to get the search engine to tell you the referrer from where it obtained that link so you can get it to stop reading the links from that page so it stops being asked to index that page on your site.

This is not a security issue.

Wow, I want to apologize for taking your time up. I somehow did add a bad link to the contact_us page in the text of the sitemap define page. I'm not sure how this happened I am glad I was able to find it though!

Next time I will do more foot work before reporting a security issue.

Jason

Glad you found the culprit!