Report

Version: 0.10.4
Scan date: 2023-11-07 08:29:55
Files analyzed: 2327 | Files infected: 14

/home1/shecan/public_html/wp-admin/includes/class-pclzip.php

Size: 192.08 kB Created: 2023-05-19 13:27:20 Modified: 2023-10-13 03:04:03 Dangers: 4
DescriptionMatch

Exploit nano Line: 2627 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

$p_options[PCLZIP_CB_PRE_ADD](PCLZIP_CB_PRE_ADD$v_local_header)

Exploit nano Line: 2785 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

$p_options[PCLZIP_CB_POST_ADD](PCLZIP_CB_POST_ADD$v_local_header)

Exploit nano Line: 3707 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

$p_options[PCLZIP_CB_PRE_EXTRACT](PCLZIP_CB_PRE_EXTRACT$v_local_header)

Exploit nano Line: 3958 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

$p_options[PCLZIP_CB_POST_EXTRACT](PCLZIP_CB_POST_EXTRACT$v_local_header)

/home1/shecan/public_html/wp-admin/includes/class-wp-debug-data.php

Size: 59.66 kB Created: 2023-07-09 19:52:24 Modified: 2023-10-13 03:04:03 Dangers: 1
DescriptionMatch

Exploit php_uname Line: 684 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute arbitrary commands or code on the target machine

php_uname'm' )

/home1/shecan/public_html/wp-admin/includes/file.php

Size: 92.88 kB Created: 2023-07-10 20:33:23 Modified: 2023-10-13 03:04:03 Dangers: 1
DescriptionMatch

Exploit nano Line: 794 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

$overrides['upload_error_handler']( &$file$message )

/home1/shecan/public_html/wp-content/themes/Divi/includes/builder/feature/display-conditions/DisplayConditions.php

Size: 19.49 kB Created: 2023-11-07 00:06:09 Modified: 2023-11-07 00:06:09 Dangers: 2
DescriptionMatch

Exploit execution Line: 370 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

base64_decode$_COOKIE['divi_post_visit'] )

Exploit execution Line: 462 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

base64_decode$_COOKIE['divi_module_views'] )

/home1/shecan/public_html/wp-content/themes/Divi/includes/builder/module/field/display-conditions/NumberOfViews.php

Size: 2.41 kB Created: 2023-11-07 00:06:09 Modified: 2023-11-07 00:06:09 Dangers: 1
DescriptionMatch

Exploit execution Line: 39 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

base64_decode$_COOKIE['divi_module_views'] )

/home1/shecan/public_html/wp-content/themes/Divi/includes/builder/module/field/display-conditions/PageVisit.php

Size: 1.96 kB Created: 2023-11-07 00:06:09 Modified: 2023-11-07 00:06:09 Dangers: 1
DescriptionMatch

Exploit execution Line: 43 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

base64_decode$_COOKIE['divi_post_visit'] )

/home1/shecan/public_html/wp-content/themes/Divi/includes/builder/class-et-builder-element.php

Size: 893.76 kB Created: 2023-11-07 00:06:09 Modified: 2023-11-07 00:06:09 Warns: 3
DescriptionMatch

Exploit double_var2 Line: 1259 Warning

Double var technique is usually used for the obfuscation of malicious code

${$name}

Exploit double_var2 Line: 1273 Warning

Double var technique is usually used for the obfuscation of malicious code

${$new_prop}

Exploit double_var2 Line: 1342 Warning

Double var technique is usually used for the obfuscation of malicious code

${$replacement}

/home1/shecan/public_html/wp-content/themes/Divi/includes/builder/class-et-builder-module-shortcode-manager.php

Size: 20.94 kB Created: 2023-11-07 00:06:09 Modified: 2023-11-07 00:06:09 Dangers: 1
DescriptionMatch

Exploit nano Line: 710 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

$module['classname']()

/home1/shecan/public_html/wp-content/plugins/wordfence/lib/wordfenceClass.php

Size: 436.59 kB Created: 2023-11-07 00:06:57 Modified: 2023-11-07 00:06:57 Dangers: 2
DescriptionMatch

Exploit execution Line: 8103 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

base64_decode($_POST['paramKey'])

Exploit file_prepend Line: 9853 Dangerous

LFI (Local File Inclusion), prepending a file at the bottom of every others PHP files, allow remote attackers to inject and execute arbitrary commands or code on the target machine

php_value auto_prepend_file

/home1/shecan/public_html/wp-content/plugins/wordfence/waf/bootstrap.php

Size: 33.63 kB Created: 2023-11-07 00:06:57 Modified: 2023-11-07 00:06:57 Warns: 1 Dangers: 1
DescriptionMatch

Exploit double_var2 Line: 876 Warning

Double var technique is usually used for the obfuscation of malicious code

${$variable}

Exploit file_prepend Line: 4 Dangerous

LFI (Local File Inclusion), prepending a file at the bottom of every others PHP files, allow remote attackers to inject and execute arbitrary commands or code on the target machine

php_value auto_prepend_file

/home1/shecan/public_html/wp-content/wflogs/config-transient.php

Size: 1.40 MB Created: 2023-11-01 17:32:01 Modified: 2023-11-07 07:57:06 Warns: 2
DescriptionMatch

Exploit base64_long Line: 6 Warning

Long Base64 encoded text is usually used for the obfuscation of malicious code

"LtyeOgWuDxRbF3p3gXdrYKGVb5Se4ghRtWBpEH0LeObkVEyi2DLEG9VLsLUd7+ihXdqs8tQU/JitWHG9xrQSw0Jbh/koXBFIJBUT/GdmVQn/bee3SsZiiReOJkUOUa7mg2rY0Z1/eDO1Kx2Z2KfNQtxcO+yE5Wp5Z6wmsiZIru+jLZXXxhoqw7kVdcx5AfpBcJWB5ipAUCZfKCuQfslJWJmWA5etMHdt+iBVhjzvzlpyLSaMBIQ1V7IREn+6e0YZLfDVNRyEnmO+uigj6bPeKwm/2mZmPx96zX/3E+vhHLfMx2XV1LLrWQNpm4ckF7V0ArvE1qkfBkzb4gq4d3WpTw=="

Exploit base64_long Warning

Long Base64 encoded text is usually used for the obfuscation of malicious code

"OHhWNyUVRiElOT8fSRNVG2sIFmAseCopbBwCNBRAPjkKBREkI1Q/BQRsGwInYzgMJztoOH16Km5pUgQ6Hjk2SU94NjddRmkWCj0PHG1/TWprfVVzZgYqeFMpRjQURj5Hd04+C2h8QQUObBsIPA0rbDorFTgDQAVuFywESB5HEkk/BkQ3W3YUFQlMP2FtATlqGQhMNBYGKgYfKUY0ajQ+S3dOPnUafE0FDgYbBDxzWRJEKxk4fQ8qEGlSBDpsOWxfP3g2N1d2FBYJQD8fH39HahUIMn8WBip4bSlKNGo0QDl3Qj51IkU/e3BsaXpCc1USOllnRkJ9VG5pXgRELTlsNz90NkklCGoVez5BHxN/ORhrdjJzFnhYBhMpRjQURj5Hd04+C2h8QT1wEht6TnNVEkQrZ0p9AyoQaSx2OmA5bDc/dDZJHHYUa3lADC1XUVMCaCUcIShVBHgdVzg0bBwKDFgzBD4qRT8FE183GxBHBycIEVRGDQN...

/home1/shecan/public_html/wp-includes/SimplePie/Parse/Date.php

Size: 20.07 kB Created: 2020-05-01 14:26:07 Modified: 2023-10-13 03:04:03 Warns: 1
DescriptionMatch

Exploit concat_vars_with_spaces Line: 837 Warning

Concatenation of vars technique is usually used for the obfuscation of malicious code

$day $fws $month $fws $year $fws .

/home1/shecan/public_html/wp-includes/rest-api.php

Size: 94.79 kB Created: 2023-10-12 13:15:24 Modified: 2023-10-13 03:04:03 Dangers: 1
DescriptionMatch

Exploit nano Line: 1630 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

$checks$type ]( $value )

/home1/shecan/public_html/.htaccess

Size: 1.31 kB Created: 2023-11-07 00:13:45 Modified: 2023-11-07 00:13:45 Dangers: 1
DescriptionMatch

Exploit file_prepend Line: 33 Dangerous

LFI (Local File Inclusion), prepending a file at the bottom of every others PHP files, allow remote attackers to inject and execute arbitrary commands or code on the target machine

php_value auto_prepend_file