cleverhog

{
    "slug": "cleverhog-malware-scanner",
    "previous_version": "1.6.9",
    "current_version": "1.7.0",
    "new_findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "includes/class-database-scanner.php",
            "line": 30,
            "snippet": "'/(?<![\\w.$])eval\\s*\\(\\s*(?:atob|String\\.fromCharCode|unescape|function\\s*\\(\\s*p\\s*,\\s*a\\s*,\\s*c\\s*,\\s*k)/i' => array( __( 'eval() of decoded JavaScript', 'cleverhog-malware-scanner' ), 'critical'",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "includes/class-database-scanner.php",
            "line": 206,
            "snippet": "'%' . $wpdb->esc_like( 'eval(' ) . '%',",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "includes/class-database-scanner.php",
            "line": 221,
            "snippet": "__( 'Option \"%s\" contains PHP code \u2014 backdoors hide payloads in the database and eval() them.', 'cleverhog-malware-scanner' ),",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "includes/class-database-scanner.php",
            "line": 304,
            "snippet": "AND (post_content LIKE '%<script%' OR post_content LIKE '%eval(%' OR post_content LIKE '%base64_decode%'",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/class-database-scanner.php",
            "line": 207,
            "snippet": "'%' . $wpdb->esc_like( 'base64_decode(' ) . '%',",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "includes/class-database-scanner.php",
            "line": 208,
            "snippet": "'%' . $wpdb->esc_like( 'gzinflate(' ) . '%'",
            "confidence": "medium"
        },
        {
            "pattern": "googlebot_cloak",
            "kind": "builtin",
            "file": "includes/class-htaccess-scanner.php",
            "line": 263,
            "snippet": "'pattern'  => '/RewriteCond\\s+%\\{HTTP_USER_AGENT\\}\\s+[^\\n]*(?:googlebot|bingbot|google|bing|yahoo|yandex|baidu|slurp)/i',",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "includes/class-signatures.php",
            "line": 74,
            "snippet": "'label'               => 'eval() of a variable (common loader for hidden payloads)',",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "includes/class-signatures.php",
            "line": 153,
            "snippet": "'label'    => 'eval() of remotely downloaded code',",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "includes/class-signatures.php",
            "line": 389,
            "snippet": "'label'     => 'eval() of decoded JavaScript (fromCharCode/atob)',",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 10
}