suspicious plugin?

[BirdOPrey5]

Originally Posted by IggyP

hmm this is a different mod than the OP linked...fwiw...

Different mod and different mod author.

[TheLastSuperman]

o.O apparently so ^ there were two reported posts and I clicked on the wrong link! Sometimes oversight is awesome .

[X-or]

Originally Posted by Dave

I checked the code and couldn't find the SQL injection backdoor, the email address gathering script is in there though but it doesn't do anything since the site it sends requests to is no longer online.

Email address gathering script?
Isn't it against the rules?

--------------- Added [DATE]1518132620[/DATE] at [TIME]1518132620[/TIME] ---------------

@Dave , could you please provide more details about this email gathering script? Sounds like a very malicious thing.

[X-or]

Nobody wants to audit this product, really?

Again I would like to stress the webmaster email was leaked after installing this product....
And maybe the whole database, who knows...
Also this is a product that outputs utterly nonsensical results which only adds to the suspicion
Is this site dead or something, why nobody looks into it

[BirdOPrey5]

Originally Posted by X-or

Nobody wants to audit this product, really?

Again I would like to stress the webmaster email was leaked after installing this product....
And maybe the whole database, who knows...
Also this is a product that outputs utterly nonsensical results which only adds to the suspicion
Is this site dead or something, why nobody looks into it

All of the above? The mod hasn't been updated in over 5 years. It probably doesn't even work on PHP 7. If you are unsure about using it, don't use it. If the results are "nonsensical" than it is no loss.

Is the site dead? Not technically, we're posting here... but it is a fraction of what it used to be and even 5 years ago it was a fraction of what it was 5 years before that.

[X-or]

Originally Posted by BirdOPrey5

The mod hasn't been updated in over 5 years.

Why does it say "Last Update: 14 Apr 2017" ?
Is this information inaccurate?

[BirdOPrey5]

Hmmm... somehow I thought this was about this mod: https://vbulletin.org/forum/showthread.php?t=241481

Oh it's because I followed the link in The Last Superman's post (#8) and assumed it was the mod in question, my bad.

I wouldn't use the mod in this post either.

--------------- Added [DATE]1533059424[/DATE] at [TIME]1533059424[/TIME] ---------------

Originally Posted by X-or

https://vborg.vbsupport.ru/showthread.php?t=324918

Can someone audit this plugin for potential malicious code?
The nonsensical results of the plugin and the apathy of the author are worrying me a lot.
Here's a mirror : https://www.sendspace.com/file/05icvb

I did a light audit... I looked through the main php file and searched for some common means of collecting/sending data and didn't notice or find anything suspicious.

It's by no means me saying it's safe to use, but there is nothing obvious to me to worry about.

I have no intention of using or installing.

[final kaoss]

Originally Posted by X-or

https://vborg.vbsupport.ru/showthread.php?t=324918

Can someone audit this plugin for potential malicious code?
The nonsensical results of the plugin and the apathy of the author are worrying me a lot.
Here's a mirror : https://www.sendspace.com/file/05icvb

Just gave it a check;
there's a link to a dead site in the xml description of it. (fuelmyforums)
and a small .js from the google cdn, all is fine here. (<script src="//ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>)

The fastest way for someone who isn't used to coding imho is to look is to open the files and do a search for "//" without the quotation marks and you'll easily find any links which could be used to send info to a external site.. Or just give a quick look through of all the files like I did.

[BirdOPrey5]

Originally Posted by final kaoss

Just gave it a check;
there's a link to a dead site in the xml description of it. (fuelmyforums)
and a small .js from the google cdn, all is fine here. (<script src="//ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>)

The fastest way for someone who isn't used to coding imho is to look is to open the files and do a search for "//" without the quotation marks and you'll easily find any links which could be used to send info to a external site.. Or just give a quick look through of all the files like I did.

Those up to no good could purposely hide this kind of code though, so be aware if you don't find any it doesn't mean it's 100% safe.