InfiniteWP Client

{
    "slug": "iwp-client",
    "finding_count": 28,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "backup.class.multicall.php",
            "line": 2817,
            "snippet": "$value = gzinflate (base64_decode(str_replace('**ZIP**', '', $value)));",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "backup.class.multicall.php",
            "line": 2817,
            "snippet": "$value = gzinflate (base64_decode(str_replace('**ZIP**', '', $value)));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "addons/file_editor/file_editor.class.php",
            "line": 198,
            "snippet": "$fileContent = base64_decode($fileContent);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "addons/file_editor/file_editor.class.php",
            "line": 199,
            "snippet": "$fileContent = gzinflate($fileContent);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "core.class.php",
            "line": 1103,
            "snippet": "$signature  = base64_decode($_GET['signature']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "core.class.php",
            "line": 1106,
            "snippet": "$signature_new = base64_decode($_GET['signature_new']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/Google2/Utils.php",
            "line": 42,
            "snippet": "return base64_decode($b64);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/Dropbox2/OAuth/Consumer/ConsumerAbstract.php",
            "line": 229,
            "snippet": "$code = base64_decode($code);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/Dropbox2/OAuth/Storage/Encrypter.php",
            "line": 89,
            "snippet": "$cipherText = base64_decode($cipherText);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/Google/Utils.php",
            "line": 44,
            "snippet": "return base64_decode($b64);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "lib/amazon_s3_bwd_comp/sdk.class.php",
            "line": 1239,
            "snippet": "elseif (($uncompressed = gzinflate($body)) !== false)",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "helper.class.php",
            "line": 341,
            "snippet": "return base64_decode(get_option('iwp_client_public_key'));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "helper.class.php",
            "line": 349,
            "snippet": "return base64_decode(get_option('iwp_client_nossl_key'));",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "init.php",
            "line": 2173,
            "snippet": "eval($params['code']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "init.php",
            "line": 144,
            "snippet": "$data = trim(base64_decode($request_raw_data));",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "1b79f5bd0cbe360eec44ce8d6d3fc1c39116823a"
}

{
    "slug": "iwp-client",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "1.13.5",
    "hit_count": 1,
    "first_hit": {
        "file": "backup/backup.php",
        "line": 2276,
        "snippet": "L2276: $var = maybe_unserialize(file_get_contents($cache_file_base.'-info.tmp'));  \u2192  L2276: $var = maybe_unserialize(file_get_contents($cache_file_base.'-info.tmp'));"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak."
}

{
    "slug": "iwp-client",
    "previous_version": "1.13.5",
    "current_version": "1.13.5",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "backup/backup.php",
            "line": 2276,
            "snippet": "L2276: $var = maybe_unserialize(file_get_contents($cache_file_base.'-info.tmp'));  \u2192  L2276: $var = maybe_unserialize(file_get_contents($cache_file_base.'-info.tmp'));",
            "confidence": "high"
        }
    ],
    "new_finding_count": 1
}