Ad Inserter – Ad Manager & AdSense Ads

{
    "slug": "ad-inserter",
    "finding_count": 86,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "class.php",
            "line": 644,
            "snippet": "eval (\"?>\". $code . \"<?php \");",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 2792,
            "snippet": "$this->w3tc_code = '$ai_code = base64_decode (\\''.base64_encode ($code).'\\'); $ai_enabled = true;';",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 2810,
            "snippet": "$w3tc_code .= 'echo base64_decode (\\'' . base64_encode ($html_code) . '\\');';",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 2854,
            "snippet": "$base64_code .= 'echo base64_decode (\\'' . base64_encode ($html_code) . '\\');';",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 3985,
            "snippet": "$ai_wp_data [AI_ACTIVE_GROUP_NAMES] = array_merge ($ai_wp_data [AI_ACTIVE_GROUP_NAMES], json_decode (base64_decode ($matches [1])));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 3988,
            "snippet": "if (($ai_wp_data [AI_WP_DEBUGGING] & AI_DEBUG_PROCESSING) != 0) ai_log ('ACTIVATED GROUPS: \"' . implode (', ', json_decode (base64_decode ($matches [1]))) . '\"');",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 3993,
            "snippet": "$processed_code = $debug_list->bar (__('ACTIVATED GROUPS', 'ad-inserter') . ': ' . implode (', ', json_decode (base64_decode ($matches [1]))), '', '') . $processed_code;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 4088,
            "snippet": "$current_group_name = implode (', ', json_decode (base64_decode ($matches [1])));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 4139,
            "snippet": "$ad_index_code = ' global $ai_groups; $ai_index = 0; if (isset ($ai_groups) && count ($ai_groups) != 0) {foreach ($ai_groups as $group_name) {foreach (unserialize (base64_decode (\\''.",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 4162,
            "snippet": "$this->w3tc_code .= '$ai_code = unserialize (base64_decode (\\''.base64_encode (serialize ($ads)).'\\'));'.$ad_index_code;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 4171,
            "snippet": "$this->w3tc_code .= ' if ($ai_index != 0) {$version_names = unserialize (base64_decode (\\''.base64_encode (serialize ($this->rotate_names)).'\\')); $ai_version_name = $version_names [$ai_in",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 4177,
            "snippet": "$this->w3tc_code .= ' if ($ai_enabled) {$groups_marker = base64_decode (\\'' . base64_encode ($groups_marker) .",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 4178,
            "snippet": "'\\'); global $ai_groups; if (preg_match ($groups_marker, $ai_code, $matches)) {if (!isset ($ai_groups)) $ai_groups = array (); $ai_groups = array_merge ($ai_groups, json_decode (base64",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 4268,
            "snippet": "$this->w3tc_code .= '$ai_amp_separator = base64_decode (\\'' . base64_encode (AD_AMP_SEPARATOR) . '\\'); $ai_amp_page = ' . ($ai_wp_data [AI_WP_AMP_PAGE] ? 'true' : 'false') . '; $ai_amp_enabl",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "class.php",
            "line": 4281,
            "snippet": "$this->w3tc_code .= '$ai_head_separator = base64_decode (\\'' . base64_encode (AD_HEAD_SEPARATOR) . '\\');';",
            "confidence": "medium"
        }
    ]
}

{
    "slug": "ad-inserter",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "2.8.13",
    "hit_count": 1,
    "first_hit": {
        "file": "ad-inserter.php",
        "line": 7294,
        "snippet": "L7293: $response = wp_remote_post ($url, array ('body' => $request));  \u2192  L7294: $plugin_info = @unserialize ($response ['body']);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}

{
    "slug": "ad-inserter",
    "previous_version": "2.8.13",
    "current_version": "2.8.13",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "ad-inserter.php",
            "line": 7294,
            "snippet": "L7293: $response = wp_remote_post ($url, array ('body' => $request));  \u2192  L7294: $plugin_info = @unserialize ($response ['body']);",
            "confidence": "high"
        }
    ],
    "new_finding_count": 1
}