Malicious Script in PRO version??

[cdogden]

Can someone tell us if this is malicious or if it is necessary to the plugin and what it is doing? We had it flagged as malicious and our site was recently infected with malware and we are upset that a PAID plugin may be at the root of the cause. We found this possible malicious script in the ‘umSupportProModel.php’ file in models > pro folder, lines 707-719 at the very end:

function loadEncDirectory( $dir ){
if (!file_exists($dir)) return;
foreach (scandir($dir) as $item) {
if( preg_match( “/Encrypted.php$/i” , $item ) ) {
$codes = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5(__CLASS__), base64_decode( file_get_contents( $dir . $item ) ), MCRYPT_MODE_CBC, md5(__CLASS__));
eval( base64_decode( file_get_contents( $dir . $item ) ) );
$className = str_replace( “Encrypted.php”, “”, $item );
if( class_exists( $className ) )
$classes[] = new $className;
}
}
return isset( $classes ) ? $classes : false;
}

}

[Support]

Hello,

These codes decode and run code from user-meta/models/enc/umProSupportModelEncrypted.php

umProSupportModelEncrypted.php file contain code to validate pro version. There are no harmful code there. You can see content of that file by applying base64_decode() function.

Thanks.

[cdogden]

Thank you for the quick response. Our person scanning our files said the eval and decode function used together are usually harmful codes, so we just wanted to be sure before continuing to use this plugin.

Thanks

[Author]

Posts