{"id":302,"date":"2011-02-17T19:10:06","date_gmt":"2011-02-17T11:10:06","guid":{"rendered":"http:\/\/lesterchan.net\/wordpress\/?p=302"},"modified":"2011-02-17T19:22:36","modified_gmt":"2011-02-17T11:22:36","slug":"code-injection-follow-up","status":"publish","type":"post","link":"https:\/\/lesterchan.net\/wordpress\/2011\/02\/17\/code-injection-follow-up\/","title":{"rendered":"Code Injection Follow Up"},"content":{"rendered":"

I have release 2 security updates to WP-Polls<\/a> and WP-PostRatings<\/a> which basically removes a malicious code that allows code injection.<\/p>\n

The malicious code is as follows:
\n
\nif ($_SERVER['PHP_SELF'] == @links_add_base_url(\"\/\", $_SERVER['HTTP_REFERER']))
\n return;
\n<\/code><\/p>\n

The code itself does nothing, but hackers are spoofing the $_SERVER['HTTP_REFERER']<\/code> that allows arbitrary code injection and note the @ sign which surpress all errors and hence the error will not be displayed.<\/p>\n

I am 100% sure based on the points below that the code was not added by me. I am beginning to believe that my account was hacked.<\/p>\n