JoomSky

{
    "slug": "js-jobs",
    "pattern": "setup.joomsky.com",
    "kind": "ioc:domain",
    "version": "2.0.2",
    "hit_count": 5,
    "first_hit": {
        "file": "includes/includer.php",
        "line": 102,
        "snippet": "define('JCONSTV', 'https://setup.joomsky.com/jsjobswp/pro/index.php');"
    },
    "explanation": null
}

{
    "slug": "js-support-ticket",
    "previous_version": "3.0.8",
    "current_version": "3.1.0",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/jssupportticket/tpls/userregister.php",
            "line": 5,
            "snippet": "wp_enqueue_script( 'ticket-recaptcha', 'https://www.google.com/recaptcha/api.js', array(), jssupportticket::$_config['productversion'], true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.google.com/recaptcha/api.js",
                "url_host": "www.google.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/jssupportticket/tpls/userregister.php",
            "line": 142,
            "snippet": "wp_enqueue_script( 'ticket-recaptcha', 'https://www.google.com/recaptcha/api.js', array(), jssupportticket::$_config['productversion'], true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.google.com/recaptcha/api.js",
                "url_host": "www.google.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/ticket/tpls/addticket.php",
            "line": 5,
            "snippet": "wp_enqueue_script( 'ticket-recaptcha', 'https://www.google.com/recaptcha/api.js', array(), jssupportticket::$_config['productversion'], true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.google.com/recaptcha/api.js",
                "url_host": "www.google.com"
            }
        }
    ],
    "new_finding_count": 3
}

{
    "slug": "js-support-ticket",
    "shape": "eval_after_remote_call",
    "file": "modules/proinstaller/controller.php",
    "line": 69,
    "snippet": "$response = curl_exec($ch); ... eval($response);",
    "remote_url": "https://setup.joomsky.com/jsticketwp/pro/index.php",
    "remote_url_obfuscation": "base64-encoded JCONSTINST constant in includes/includer.php:71",
    "ssl_verify": false,
    "vendor": "JoomSky / rabilal",
    "active_installs": 8000,
    "current_response_payload": "echo Please download new installer from www.joomsky.com",
    "audit_rationale": "Vendor-shipped permanent eval(remote-PHP) primitive: SSL verification disabled, URL base64-encoded in source. Server response is benign today but the architecture is a fully-armed update-hijack vector affecting 8000 installs.",
    "discovered_by": "wp beacon hunt-updaters (eval_after_remote_call pattern)"
}