Well regarding PHP I guess only time will tell whether the site is safe or not now, I'm reserving judgement as the last site this happened on was completely hosted and one would presume that it would have been allot more secure than the one i'm hosting myself.

If DotNetNuke wasn't eleviated in anyway, so what you are suggesting is that any site running PHP can be hacked extremely easily in this way?

"But with that aside, I think that one of the possible holes was actually this Feedback module."

That is what I said, and I chose my words carefully, I said that it is a possible hole, and the reason for that was that it was being targeted, so I can assure you that you misunderstood there by not reading thoroughly.  If on the other hand you are referring to the subject of the thread then I think it's a bit generic and anyone interested enough would actually read it before casting judgement themselves.

This is not an issue, as the path would not be resolved as it does not contain an asp.net page extension prior to the querystring i.e. an extension ending .aspx/.ashx/.asmx/.axd . I also checked the last 2 releases of the feedback module (going back to1/30/2007) and netiher has code that references a querystring, request or paramters variable called include_path. I also checked a few recent core releases and they do not reference it either, so what your'e seeing is random url requests (much like the recent sql worm) that will not cause any harm and simply get logged as invalid requests. As per other posters, I would recommend that you mail the security@dotnetnuke.com so that the security team can process any reported problems - i've been off for a few days holiday but there are at least another 6 people who monitor that alias.

And and as for your question, we've received messages from 55 different people so far this calendar year (we've responded to a couple of hundred reports and requests).

Cathal