It's not a backdoor neither a CMS bug, just a problem in the .htaccess. Too bad the owners have not checked this. None of the ones mentioned are clients of ours.
Some are managed through ccbill, some are epoch's, so not sure if it is their overlooking or the sysadmins but clearly the owners should be notified in order to take action.
I also agree with Raymors comment that often owners are told but dont do anything because they do not like being told they have done something wrong.
