Quote:
Originally Posted by k0nr4d
You could always just disable eval() on your server's php.ini:
disable_functions = eval
I've never seen that used outside of hacking scripts. The general rule of thumb with eval (as a programmer) is that if you ever find yourself having to use it, you did something wrong. They even have a big 'caution' box listed on php.net on that topic:
http://lu.php.net/eval |
The problem is NATS and ElevatedX both use eval so it cant be disabled for most webmasters. The best I can tell this hacker has 2 modes of operation; he either breaks into the nats admin and uses the templates (or upload documents) to inject code or he uses outdated versions of myphpadmin. You should have IP access turned on for NATS and IP restriction on your myphpadmin install.