Author: I was on our site yesterday, and found I was getting an error trying to view our forum.
I was able to view the index page, but when clicking on any forum area to view the topics in that forum area, I got this error:
Parse error: syntax error, unexpected T_STRING, expecting ',' or ';' in /home/aaquac5/public_html/bindepot.net/forum/viewforum.php on line 273
So I opened the file and compared it to a newly downloaded viewforum.php file, and found some code injected in the file.
Line 272 and before was ok, but the next couple lines were not supposed to be there.
What it should look like:
// Redirect via an HTML form for PITA webservers if (@preg_match('/Microsoft|WebSTAR|Xitami/', getenv('SERVER_SOFTWARE'))) { header('Refresh] . '</title></head><body><div>' . sprintf($lang['Rediect_to'], '<a>', '</a>') . '</div></body></html>'; exit; } // Behave as per HTTP/1.1 spec for others header('Location: ' . $url); exit;}//-- fin mod : categories hierarchy ----------------------------------------------------------------
What was in mine:
// Redirect via an HTML form for PITA webservers if (@preg_match('/Microsoft|WebSTAR|Xitami/', getenv('SERVER_SOFTWARE'))) { header('Refresh] . '</title></head><body><div>' . sprintf($lang['Rediect_to'], '<a>', '</a>') . '</div><ed19d794e594f5827df26f9ff1c925ab><0873547521><a> </a><ed19d794e594f5827df26f9ff1c925ab></body></html>'; exit; } // Behave as per HTTP/1.1 spec for others header('Location: ' . $url); exit;}//-- fin mod : categories hierarchy ----------------------------------------------------------------
The injected code:
<ed19d794e594f5827df26f9ff1c925ab><0873547521><a> </a><ed19d794e594f5827df26f9ff1c925ab>
This has been found in some of my other sites also.
Removing the code fixed the file and site.
Anyway to prevent this from happening again?
