Admin Tools

#26369 Files not flagged as suspicious by file scanner

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by on Wednesday, 23 November 2016 17:17 CST

Sunday, 23 October 2016 14:44 CDT

rhellyer

By running the php file scanner in Admin tools, I noticed that a couple of files had been added to the plugins directory (bc.php and upstream.php). They are malicious, but for some reason weren't flagged as such by the file scanner (threat score was 0)

Is this because they just slipped through the Admin tools checker, or could there be some other reason (eg. how I have it configured)?

thanks, Richard

Files attached in a zip

Monday, 24 October 2016 03:25 CDT

tampe125

Hello Richard,

can you please try to attach them again or (if they are too big), upload them somewhere and post here the link?

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Monday, 24 October 2016 09:49 CDT

rhellyer

Here's a link to the zipped files

https://drive.google.com/open?id=0B259JW32ACNsX1lkYjRhMkliR3c

Monday, 24 October 2016 10:21 CDT

tampe125

Thank you very much for your files.
Upstream.php seems a legit file, most likely some extension put it there and tried to access it directly.
The other one is indeed malicious, thank you very much for your report.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Wednesday, 23 November 2016 17:17 CST

System Task

system

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Support