site dosyalarında "eval" kelimesi aratıldığında;
jquery.tabs.pack, jquery.history_remote.pack, dhtmllib, ioelement , ioelement.sync, templmngr, htmlmenu, groupmanager, functions.image, debug, dynkeyevent, jquery, fckeditorcode_ie, fckeditorcode_gecko, fcktoolbarset, fcklanguagemanager, fckxml, wordWindow, controlWindow, spellChecker, fck_2_gecko, fckxml_gecko, adlı jawascript dosyalarında ve
commands.pl ve upload_fck.pl adlı iki dosyada olduğu görülüyor.
Başka dosyalarda tanımlanmıyor ancak .ndex.php dosyasının içindede ;
<td><table width="100%" border="0" cellspacing="0" cellpadding="0">
<td>
<? $sorgu = "SELECT * FROM t_tablo_yonetimi where Visible='1' and ID='5' ";
$goster = mysql_query($sorgu);
$goster1 = mysql_fetch_array($goster);
$degisken = $goster1['Tablokodu'];
eval( "?>".$degisken."<?php ");
?>
</td>
kodu var.
commands.pl Adlı dosyada;
sub FileUpload
{
eval("use File::Copy;");
local($resourceType, $currentFolder) = @_;
$sErrorNumber = '0' ;
$sFileName = '' ;
if($new_fname) {
# Map the virtual path to the local server path.
$sServerDir = &ServerMapFolder($resourceType,$currentFolder);
# Get the uploaded file name.
$sFileName = $new_fname;
$sOriginalFileName = $sFileName;
$iCounter = 0;
while(1)
{
$sFilePath = $sServerDir . $sFileName;
if(-e $sFilePath)
{
$iCounter++ ;
($path,$BaseName,$ext) = &RemoveExtension($sOriginalFileName);
$sFileName = $BaseName . '(' . $iCounter . ').' . $ext;
$sErrorNumber = '201';
}
else
{
copy("$img_dir/$new_fname","$sFilePath");
chmod(0777,$sFilePath);
unlink("$img_dir/$new_fname");
last;
}
}
}
else
{
$sErrorNumber = '202' ;
}
$sFileName =~ s/"/\\"/g;
print "Content-type: text/html\n\n";
print '<script type="text/javascript">';
print 'window.parent.frames["frmUpload"].OnUploadCompleted(' . $sErrorNumber . ',"' . $sFileName . '") ;';
print '</script>';
exit ;
}
1;
kodu,
upload_fck.pl adlı dosyada da;
sub read_input
{
eval("use File::Copy;");
eval("use File:
ath;");
my ($FORM) = @_;
mkdir($img_dir,0777);
chmod(0777,$img_dir);
undef $img_data_exists;
undef @NEWFNAMES;
undef @NEWFNAME_DATA;
if($ENV{'CONTENT_LENGTH'} > 10000000 || $ENV{'CONTENT_LENGTH'} > $MAX_CONTENT_SIZE * 1024)
{
&upload_error(
'Size Error',
sprintf(
"Transmitting size is too large.MAX <strong>%d KB</strong> Now Size <strong>%d KB</strong>(<strong>%d bytes</strong> Over)",
$MAX_CONTENT_SIZE,
int($ENV{'CONTENT_LENGTH'} / 1024),
$ENV{'CONTENT_LENGTH'} - $MAX_CONTENT_SIZE * 1024
)
);
}
my $Buffer;
if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data/)
{
# METHOD POST only
return unless($ENV{'CONTENT_LENGTH'});
binmode(STDIN);
# STDIN A pause character is detected.'(MacIE3.0 boundary of $ENV{'CONTENT_TYPE'} cannot be trusted.)
my $Boundary = <STDIN>;
$Boundary =~ s/\x0D\x0A//;
$Boundary = quotemeta($Boundary);
while(<STDIN>)
{
if(/^\s*Content-Disposition:/i)
{
my($name,$ContentType,$FileName);
# form data get
if(/\bname="([^"]+)"/i || /\bname=([^\s:;]+)/i)
{
$name = $1;
$name =~ tr/+/ /;
$name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
&Encode(\$name);
}
if(/\bfilename="([^"]*)"/i || /\bfilename=([^\s:;]*)/i) {
$FileName = $1 || 'unknown';
}
# head read
while(<STDIN>) {
last if(! /\w/);
if(/^\s*Content-Type:\s*"([^"]+)"/i || /^\s*Content-Type:\s*([^\s:;]+)/i) {
$ContentType = $1;
}
}
# body read
$value = "";
while(<STDIN>) {
last if(/^$Boundary/o);
$value .= $_;
};
$lastline = $_;
$value =~s /\x0D\x0A$//;
if($value ne '') {
if($FileName || $ContentType) {
$img_data_exists = 1;
(
$FileName, #
$Ext, #
$Length, #
$ImageWidth, #
$ImageHeight, #
$ContentName #
) = &CheckContentType(\$value,$FileName,$ContentType);
$FORM{$name} = $FileName;
$new_fname = $FileName;
push(@NEWFNAME_DATA,"$FileName\t$Ext\t$Length\t$ImageWidth\t$ImageHeight\t$ContentName");
# Multi-upload correspondence
push(@NEWFNAMES,$new_fname);
open(OUT,">$img_dir/$new_fname");
binmode(OUT);
eval "flock(OUT,2);" if($PM{'flock'} == 1);
print OUT $value;
eval "flock(OUT,8);" if($PM{'flock'} == 1);
close(OUT);
kodu var.
