Header Exploit?

soaringpine · 04-02-2012, 05:49 PM

Hi guys, my calendar quit working out of the blue all of a sudden and I am still trying to determine why. I assumed my provider upgraded php version automatically but that wasn't the case. So I reinstalled some of the files thinking that might do the trick. Contacted my provider after they blocked my IP address because they said the calendar/events/editors/tinymce/header.php file contains an exploit.

My site will not work at all - I am receiving the following message:

Fatal error: Incompatible file format: The encoded file has format major ID 2, whereas the Loader expects 4 in /home2/pack414/public_html/calendar/functions/functions.inc.php on line 0

Cannot access the admin panel for the calendar either - ssI receive the same message.

Any help is much appreciated. This is a Cub Scout site and I need to get it back up and running ASAP. THANKS!

ve9gra · 04-02-2012, 06:14 PM

Download the Tester script and check which version it tells you you need. Download the .zip version and then follow the upgrade documentation to replace the system files only.

http://docs.easyphpcalendar.com/

ve9gra · 04-02-2012, 06:16 PM

Oh, and before you blow away the old files, I would suggest that you open a support ticket and upload the file that your host told you had an exploit. Brian will be able to confirm if it had been tampered.

**Brian** · 04-02-2012, 11:14 PM

And that file is part of TinyMCE and not part of the calendar. Make sure you are using the latest release of TinyMCE.

ve9gra · 04-03-2012, 06:33 AM

Err... Brian, this file is part of the EPC package... no?

calendar/events/editors/tinymce/header.php

**Brian** · 04-03-2012, 10:22 AM

You're absolutely correct. I misread the path.

That file is in plain-text and there is no code that can execute anything else. It's possible that on outside script or user modified that file and included malicious code in it. You may want to see if your host can tell when and who/how that file was modified.

soaringpine · 04-03-2012, 01:17 PM

I downloaded the latest version and updated the appropriate files and the server still does not like it (exploit showing up). Before I did that I ran the /tester directory and everything checked out fine.

**Brian** · 04-03-2012, 01:28 PM

You're going to need to send me that file and/or give me more specific details about it because I have no idea what you mean by exploit.

I assure you that it is not distributed with the calendar.