SQL INJECTION IN TAGDIV COMPOSER AGAIN!!!

Just to let you know, its happens agains. The code has been put again in my CUSTOM JAVASCRIPT as we were discussing here: https://forum.tagdiv.com/topic/jskryptik-co-trojan-found-in-composer-plugin/#pos

PLEASE SOLVE THIS ASAP!!!!

AND NOW ALSO IN CUSTOM HTML!!! See atached image: https://ibb.co/Qbs0Xjn

SOLVE IT!!!!

Have you read the post attached on my first comment? Its a clear vulnerability of your theme. Im not the one with the problem mate.

I repeat the one thing I have said you in the other post, THEY ARE USING A VULNERABILITY OF TAG DIV to put it there.

Ok thats the answer I wanted. I would update asap.

If any file infected in all the server files then the malware will run ALWAYS. The problem is that the malware only works when the hacker use tdcomposer / tdpanel option (as my partner and I said) to put into the custom javascript and custom html.

When you delete the code from there (I made 2 days ago and, fortunately, it doesn’t appears again) and clean caches, all works fine. When the code is injected and caches are not cleaned, the code doesn’t works because it has been not applied. I mean, it only happens when someone use td panel vulnerability to inject it. I don´t know if only in old version, I have 11.5.1.

Thanks for the help

Hi, Calin, is there any tutorial to explain how to fix this problem: “injected code has been removed”?

He wanted to say that before updating to new version, you have to delete the code if is in the custom JavaScript and custom HTML fields in theme panel > custom codes. I updated yesterday, will see if it works (hoping to work or we will drive crazy).

@loslunes, yeah, I’ve got it. But how can I delete the injected code in the Javascript of custom HTML? I’ve run a anti-malware and detected in my PC. I’m afraid to proceed with the updating prior than eliminate the malware on the site.

Is there a changelog for which files were updated? Is this a security issue in TD Composer or Theme itself?

Okay, I just found your patch, and it is NOT a patch. It’s a bandaid at most. In td-composer/legacy/common/wp_booster/wp-admin/panel/panel_core/td_pannel_data_source.php:610 you have simply added in

			// don't allow eval( / String.fromCharCode( as option value
	        if ( td_util::strpos_array( $option_value, array( 'eval(', 'String.fromCharCode(' ) ) !== false ) {
		        $option_value = '';
	        }

this does not fix the core problem of an unauthenticated user being able to use admin-ajax.php and your td_ajax_update_panel action and td_magic_token to inject anything they want. What if they just change their method and obfuscate their code, it will pass right by this “check” and sites will once again be infected.

• This reply was modified 3 years by nearview.