0

Recently I have downloaded a wordpress theme . I use Theme Authenticity Checker (TAC) (http://wordpress.org/plugins/tac/) plugin to find any malicious data . According to it's report the theme contains some encrypted code like this

$pid        = base64_decode($_POST['control_id']);  

I don't understand , is it really harmful for site ? If yes , then how can I get rid of this ?

4
  • 1
    What is the theme? Aug 15, 2013 at 13:52
  • Without seeing the theme code in context I couldn't say with confidence but I'd guess this is not malicious. You should be able to echo or var_dump the $pid variable and exactly what the encoded (not encrypted) data is.
    – s_ha_dum
    Aug 15, 2013 at 14:01
  • This is the site smile auction theme Aug 15, 2013 at 16:51
  • What is the different between encoded and encrypted ? Aug 15, 2013 at 17:21

2 Answers 2

2

That is most likely a false positive : https://en.wikipedia.org/wiki/Type_I_and_type_II_errors

base64_decode is not bad in of itself : https://en.wikipedia.org/wiki/Base64

The plugin is not smart enough to know a legitimate reason to use base64_decode of which there are many.

2
  • Thanks , do you know any other plugin which will be smart enough ? Aug 15, 2013 at 16:54
  • No I don't use "security" plugins , sorry.
    – Wyck
    Aug 16, 2013 at 1:05
1

It does not seems to be harmful. Looks like, base64_decode function is just used to decrypt the encrypted the numeric IDs. Common reason for such encryption/decryption is to hide the real ID of the database record.

TAC plugin pointed it out because base64_decode function is widely used in malicious scripts to hide programming code which is later used in eval for execution.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.