From 4269e4713d9d54296e07391d130f711311b152fb Mon Sep 17 00:00:00 2001 From: imrcli-remediator Date: Sat, 18 Jul 2026 18:04:24 +0200 Subject: [PATCH] =?UTF-8?q?quarantine:=20family=3Deval-backdoor=20(3=20f?= =?UTF-8?q?=C3=A1jl)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vhost: partners.archlinexp.com rel_path: system/scaffolding/images/gifimg.php result: quarantined evidence_sha256: d4589fe08c02205df01c3176bd1b5c4729926aae6afe0231e936e3aee7729cde timestamp: 20260718T160424Z finding_ref: 5427 vhost: www.cadline.hu rel_path: public/mysqldumper/images/gifimg.php result: quarantined evidence_sha256: d4589fe08c02205df01c3176bd1b5c4729926aae6afe0231e936e3aee7729cde timestamp: 20260718T160424Z finding_ref: 5648 vhost: www.cadline.hu rel_path: system/scaffolding/images/gifimg.php result: quarantined evidence_sha256: d4589fe08c02205df01c3176bd1b5c4729926aae6afe0231e936e3aee7729cde timestamp: 20260718T160424Z finding_ref: 5561 --- .../partners/system/scaffolding/images/gifimg.php | 1 + .../scaffolding/images/gifimg.php.evidence.json | 15 +++++++++++++++ .../www/public/mysqldumper/images/gifimg.php | 1 + .../mysqldumper/images/gifimg.php.evidence.json | 15 +++++++++++++++ .../www/system/scaffolding/images/gifimg.php | 1 + .../scaffolding/images/gifimg.php.evidence.json | 15 +++++++++++++++ 6 files changed, 48 insertions(+) create mode 100644 var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php create mode 100644 var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php.evidence.json create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php.evidence.json create mode 100644 var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php create mode 100644 var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php.evidence.json diff --git a/var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php b/var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php new file mode 100644 index 0000000..a99c50e --- /dev/null +++ b/var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php.evidence.json b/var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php.evidence.json new file mode 100644 index 0000000..09517e4 --- /dev/null +++ b/var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "5427", + "log_excerpt": "[quarantine] partners.archlinexp.com:system/scaffolding/images/gifimg.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.com/partners/system/scaffolding/images/gifimg.php)", + "original_sha256": "d4589fe08c02205df01c3176bd1b5c4729926aae6afe0231e936e3aee7729cde", + "original_stat": { + "gid": 30037, + "mtime": 1396359178, + "size": 109, + "uid": 11669 + }, + "rel_path": "system/scaffolding/images/gifimg.php", + "result": "quarantined", + "timestamp": "20260718T160424Z", + "vhost": "partners.archlinexp.com" +} diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php b/var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php new file mode 100644 index 0000000..a99c50e --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php.evidence.json b/var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php.evidence.json new file mode 100644 index 0000000..049a9ba --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "5648", + "log_excerpt": "[quarantine] www.cadline.hu:public/mysqldumper/images/gifimg.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/cadline.hu/www/public/mysqldumper/images/gifimg.php)", + "original_sha256": "d4589fe08c02205df01c3176bd1b5c4729926aae6afe0231e936e3aee7729cde", + "original_stat": { + "gid": 30037, + "mtime": 1242504763, + "size": 109, + "uid": 11669 + }, + "rel_path": "public/mysqldumper/images/gifimg.php", + "result": "quarantined", + "timestamp": "20260718T160424Z", + "vhost": "www.cadline.hu" +} diff --git a/var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php b/var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php new file mode 100644 index 0000000..a99c50e --- /dev/null +++ b/var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php.evidence.json b/var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php.evidence.json new file mode 100644 index 0000000..0c145e9 --- /dev/null +++ b/var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "5561", + "log_excerpt": "[quarantine] www.cadline.hu:system/scaffolding/images/gifimg.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/cadline.hu/www/system/scaffolding/images/gifimg.php)", + "original_sha256": "d4589fe08c02205df01c3176bd1b5c4729926aae6afe0231e936e3aee7729cde", + "original_stat": { + "gid": 30037, + "mtime": 1396359178, + "size": 109, + "uid": 11669 + }, + "rel_path": "system/scaffolding/images/gifimg.php", + "result": "quarantined", + "timestamp": "20260718T160424Z", + "vhost": "www.cadline.hu" +}