Title: Injection Blocked?
Last modified: August 31, 2016

---

# Injection Blocked?

 *  Resolved [awakegal](https://wordpress.org/support/users/awakegal/)
 * (@awakegal)
 * [10 years, 3 months ago](https://wordpress.org/support/topic/injection-blocked/)
 * This showed up in my log tonight:
    24/Feb/16 17:59:31 #3855502 critical – 192.185.4.18
   POST /index.php – BASE64-encoded injection – [POST:z0 = ZXZhbCgiZWNobygxMjM0NTQzMjArMSk7ZXhpdCgpOyIp]
 * and this is from Wordfence:
    File appears to be malicious: wp-content/nfwlog/
   firewall_2016-02.php Filename: wp-content/nfwlog/firewall_2016-02.php File type:
   Not a core, theme or plugin file. Issue first detected: 1 hour 6 mins ago. Severity:
   Critical Status New This file appears to be installed by a hacker to perform 
   malicious activity. If you know about this file you can choose to ignore it to
   exclude it from future scans. The text we found in this file that matches a known
   malicious file is: “ZXZhbC”.
 * I am hoping that NF blocked the injection and WF is flagging the log because 
   it contains the name “ZXZhbC”.
 * Is this true?
 * Thanks!
 * [https://wordpress.org/plugins/ninjafirewall/](https://wordpress.org/plugins/ninjafirewall/)

Viewing 2 replies - 1 through 2 (of 2 total)

 *  Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/)
 * (@nintechnet)
 * [10 years, 3 months ago](https://wordpress.org/support/topic/injection-blocked/#post-7110518)
 * Hi,
 * That’s right.
    NinjaFirewall blocked that hacking attempt (“ZXZhbCgiZWNobygxMjM0NTQzMjArMSk7ZXhpdCgpOyIp”
   is the base64-encoded string for `eval("echo(123454320+1);exit();")`) and it 
   wrote the incident to its log. The log contains samples of each blocked threat,
   thus I don’t recommend to scan it.
 *  Thread Starter [awakegal](https://wordpress.org/support/users/awakegal/)
 * (@awakegal)
 * [10 years, 3 months ago](https://wordpress.org/support/topic/injection-blocked/#post-7110655)
 * thank you !

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Injection Blocked?’ is closed to new replies.

 * ![](https://ps.w.org/ninjafirewall/assets/icon-256x256.png?rev=976137)
 * [NinjaFirewall (WP Edition) - Advanced Security Plugin and Firewall](https://wordpress.org/plugins/ninjafirewall/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/ninjafirewall/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/ninjafirewall/)
 * [Active Topics](https://wordpress.org/support/plugin/ninjafirewall/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/ninjafirewall/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/ninjafirewall/reviews/)

 * 2 replies
 * 2 participants
 * Last reply from: [awakegal](https://wordpress.org/support/users/awakegal/)
 * Last activity: [10 years, 3 months ago](https://wordpress.org/support/topic/injection-blocked/#post-7110655)
 * Status: resolved