FM / nfwlog

/home/altere25/infinet.finance/wp-content/nfwlog/

/home/altere25/infinet.finance/wp-content/nfwlog

Name	Size	Mode	Actions
cache/	-	0755	rm
.htaccess	378	0644	edit dl rm
dropins.php	6422	0644	edit dl rm
error_log.php	1093	0644	edit dl rm
firewall_2023-04.php	62449	0644	edit dl rm
firewall_2023-05.php	171664	0644	edit dl rm
firewall_2023-06.php	12555	0644	edit dl rm
firewall_2023-07.php	83608	0644	edit dl rm
firewall_2023-08.php	4922	0644	edit dl rm
firewall_2023-09.php	3014	0644	edit dl rm
firewall_2023-10.php	19061	0644	edit dl rm
firewall_2023-11.php	8019	0644	edit dl rm
firewall_2023-12.php	29773	0644	edit dl rm
firewall_2024-01.php	14306	0644	edit dl rm
firewall_2024-02.php	21398	0644	edit dl rm
firewall_2024-03.php	21999	0644	edit dl rm
firewall_2024-04.php	19492	0644	edit dl rm
firewall_2024-05.php	4278	0644	edit dl rm
firewall_2024-06.php	1381	0644	edit dl rm
firewall_2024-07.php	3887	0644	edit dl rm
firewall_2024-08.php	157388	0644	edit dl rm
firewall_2024-09.php	3971	0644	edit dl rm
firewall_2024-10.php	3817	0644	edit dl rm
firewall_2024-11.php	3273	0644	edit dl rm
firewall_2024-12.php	4907	0644	edit dl rm
firewall_2025-01.php	2909	0644	edit dl rm
firewall_2025-02.php	6016	0644	edit dl rm
firewall_2025-03.php	2493	0644	edit dl rm
firewall_2025-04.php	4572	0644	edit dl rm
firewall_2025-05.php	3768	0644	edit dl rm
firewall_2025-06.php	4758	0644	edit dl rm
firewall_2025-07.php	7896	0644	edit dl rm
firewall_2025-08.php	5583	0644	edit dl rm
firewall_2025-09.php	2991	0644	edit dl rm
firewall_2025-10.php	8796	0644	edit dl rm
firewall_2025-11.php	5472	0644	edit dl rm
firewall_2025-12.php	21464	0644	edit dl rm
firewall_2026-01.php	18929	0644	edit dl rm
firewall_2026-02.php	4290	0644	edit dl rm
firewall_2026-03.php	6133	0644	edit dl rm
firewall_2026-04.php	9911	0644	edit dl rm
firewall_2026-05.php	124245	0644	edit dl rm
firewall_2026-06.php	17975	0644	edit dl rm
firewall_2026-07.php	7366	0644	edit dl rm
firewall_2026-08.php	23349	0644	edit dl rm
firewall_2026-09.php	222	0644	edit dl rm
index.html	1	0644	edit dl rm
ninjafirewall.php	717	0644	edit dl rm
readme.txt	244	0644	edit dl rm
stats_2023-04.php	38	0644	edit dl rm
stats_2023-05.php	39	0644	edit dl rm
stats_2023-06.php	36	0644	edit dl rm
stats_2023-07.php	38	0644	edit dl rm
stats_2023-08.php	33	0644	edit dl rm
stats_2023-09.php	33	0644	edit dl rm
stats_2023-10.php	35	0644	edit dl rm
stats_2023-11.php	34	0644	edit dl rm
stats_2023-12.php	35	0644	edit dl rm
stats_2024-01.php	35	0644	edit dl rm
stats_2024-02.php	35	0644	edit dl rm
stats_2024-03.php	36	0644	edit dl rm
stats_2024-04.php	36	0644	edit dl rm
stats_2024-05.php	33	0644	edit dl rm
stats_2024-06.php	33	0644	edit dl rm
stats_2024-07.php	33	0644	edit dl rm
stats_2024-08.php	35	0644	edit dl rm
stats_2024-09.php	33	0644	edit dl rm
stats_2024-10.php	33	0644	edit dl rm
stats_2024-11.php	33	0644	edit dl rm
stats_2024-12.php	34	0644	edit dl rm
stats_2025-01.php	33	0644	edit dl rm
stats_2025-02.php	33	0644	edit dl rm
stats_2025-03.php	33	0644	edit dl rm
stats_2025-04.php	34	0644	edit dl rm
stats_2025-05.php	33	0644	edit dl rm
stats_2025-06.php	33	0644	edit dl rm
stats_2025-07.php	34	0644	edit dl rm
stats_2025-08.php	33	0644	edit dl rm
stats_2025-09.php	33	0644	edit dl rm
stats_2025-10.php	33	0644	edit dl rm
stats_2025-11.php	34	0644	edit dl rm
stats_2025-12.php	35	0644	edit dl rm
stats_2026-01.php	36	0644	edit dl rm
stats_2026-02.php	33	0644	edit dl rm
stats_2026-03.php	34	0644	edit dl rm
stats_2026-04.php	35	0644	edit dl rm
stats_2026-05.php	29	0644	edit dl rm
stats_2026-06.php	35	0644	edit dl rm
stats_2026-07.php	34	0644	edit dl rm
stats_2026-08.php	36	0644	edit dl rm
stats_2026-09.php	33	0644	edit dl rm
updates.php	31575	0644	edit dl rm

Edit: /home/altere25/infinet.finance/wp-content/nfwlog/dropins.php (6422B)

<?php // NinjaFirewall's drop-in rules ~ Do not delete this file!
  if (! defined( 'NFW_ENGINE_VERSION' ) ) { die( 'Forbidden' ); } if (defined('WP_CLI') && WP_CLI ) { return; } if (! is_super_admin() ) { if ( isset( $_REQUEST['action'] ) ) { if ( $_REQUEST['action'] == 'rs_ajax_action' && $_POST['client_action'] == 'library.load.image' && isset( $_POST['data'][0]['id'] ) ) { if ( preg_match('/\.php$/', $_POST['data'][0]['id'] ) ) { nfw_dropin_block("REQUEST:action = library.load.image, File = {$_POST['data'][0]['id']}", 3, 1642); } } if ( $_REQUEST['action'] == 'wpr_addons_upload_file' && ! empty( $_FILES['uploaded_file'] ) ) { $res = strtolower( wp_unique_filename( __DIR__, $_FILES['uploaded_file']['name'] ) ); if ( preg_match('/\.(?:ph(?:p([34x7]|5\d?)?|t(ml)?|ar)|html?)\b/', $res ) ) { nfw_dropin_block("REQUEST:action = wpr_addons_upload_file, File = {$_FILES['uploaded_file']['name']}", 3, 1630); } } if ( $_REQUEST['action'] == 'dnd_codedropz_upload' && ! empty( $_FILES['upload-file'] ) ) { $res = strtolower( wp_unique_filename( __DIR__, $_FILES['upload-file']['name'] ) ); if ( preg_match('/\.ht(?:access|passwd)|(?:php\d?|\.user)\.ini|\.ph(?:p([34x7]|5\d?)?|t(ml)?|ar)(?:\.|$)/', $res ) ) { nfw_dropin_block("REQUEST:action = dnd_codedropz_upload, File = {$_FILES['upload-file']['name']}", 3, 1631); } } if ( ( $_REQUEST['action'] == 'everest_forms_upload_file' || $_REQUEST['action'] == 'everest_forms_remove_file') && nfw_dropin_isvulnplugin('everest-forms/everest-forms.php', '3.0.9.5') === true ) { nfw_dropin_block("REQUEST:action = {$_REQUEST['action']}", 3, 1640 ); } if ( $_REQUEST['action'] == 'userpro_fbconnect' && nfw_dropin_isvulnplugin('userpro/index.php', '5.1.5') === true ) { nfw_dropin_block("REQUEST:action = userpro_fbconnect", 3, 1633); } if ( $_REQUEST['action'] == 'wpr_addons_upload_file' && ! empty( $_FILES['uploaded_file'] ) && ! preg_match('/\.(?:jpe?g|png|gif|pdf|docx?|pptx?|odt|avi|ogg|m4a|mov|mp3|mp4|mpg|wav|wmv|txt)$/', $_FILES['uploaded_file']['name'] ) ) { nfw_dropin_block("REQUEST:uploaded_file = {$_FILES['uploaded_file']['name']}", 3, 1636); } if ( $_REQUEST['action'] == 'userpro_process_form' && $_POST['template'] == 'change' && nfw_dropin_isvulnplugin('userpro/index.php', '5.1.9') === true ) { nfw_dropin_block("REQUEST:action = userpro_process_form/change", 3, 1637); } } global $wp_version; if ( version_compare( $wp_version, '6.8', '>=') && version_compare( $wp_version, '7.0.1', '<=') ) { if ( isset( $_SERVER['REQUEST_URI'] ) && stripos( $_SERVER['REQUEST_URI'], '/batch/v1') || isset( $_SERVER['rest_route'] ) && stripos( $_SERVER['rest_route'], '/batch/v1') ) { if ( is_user_logged_in() === false ) { nfw_dropin_block('WordPress vulnerability', 3, 1646); } } } if ( isset( $_SERVER['HTTP_X_BURSTMAINWP'] ) && isset ( $_SERVER['HTTP_AUTHORIZATION'] ) && nfw_dropin_isvulnplugin('burst-statistics/burst.php', '3.4.2') === true ) { nfw_dropin_block("HTTP_AUTHORIZATION: {$_SERVER['HTTP_AUTHORIZATION']}", 3, 1643); } if ( isset( $_COOKIE['litespeed_role'] ) && isset( $_COOKIE['litespeed_hash'] ) && nfw_dropin_isvulnplugin('litespeed-cache/litespeed-cache.php', '6.4') === true ) { nfw_dropin_block('Unauthenticated action', 3, 1638); } if ( ( isset( $_SERVER['REQUEST_URI'] ) && stripos( $_SERVER['REQUEST_URI'], '/bricks/v1/render_element') || isset( $_REQUEST['rest_route'] ) && stripos( $_REQUEST['rest_route'], '/bricks/v1/render_element') ) && ! current_user_can('edit_posts') ) { nfw_dropin_block("Unauthenticated action", 3, 1635); } if ( ( isset( $_SERVER['REQUEST_URI'] ) && stripos( $_SERVER['REQUEST_URI'], '/sure-triggers/v1/connection/create-wp-connection') || isset( $_REQUEST['rest_route'] ) && stripos( $_REQUEST['rest_route'], '/sure-triggers/v1/connection/create-wp-connection') ) && nfw_dropin_isvulnplugin('suretriggers/suretriggers.php', '1.0.83') === true ) { nfw_dropin_block('Privilege escalation', 3, 1641); } if ( ( isset( $_SERVER['REQUEST_URI'] ) && stripos( $_SERVER['REQUEST_URI'], 'reallysimplessl/v1/two_fa/skip_onboarding') || isset( $_REQUEST['rest_route'] ) && stripos( $_REQUEST['rest_route'], 'reallysimplessl/v1/two_fa/skip_onboarding') ) && ( nfw_dropin_isvulnplugin('really-simple-ssl/rlrsssl-really-simple-ssl.php', '9.1.2') === true || nfw_dropin_isvulnplugin('really-simple-ssl-pro/really-simple-ssl-pro.php', '9.1.2') === true ) && isset( $_REQUEST['user_id'] ) && $_REQUEST['user_id'] == 1 ) { nfw_dropin_block("Unauthenticated action", 3, 1639); } if ( (! empty( $_POST['save_root'] ) && isset( $_POST['wp_extra']['htaccess_root'] ) ) || (! empty( $_POST['save_content'] ) && isset( $_POST['wp_extra']['htaccess_content'] ) ) || (! empty( $_POST['save_includes'] ) && isset( $_POST['wp_extra']['htaccess_includes'] ) ) ) { nfw_dropin_block( "wp_extra = ". json_encode( $_POST['wp_extra'] ), 3, 1632 ); } if ( isset( $_POST['directorist_reset_password'] ) && nfw_dropin_isvulnplugin('directorist/directorist-base.php', '7.5.5') === true ) { nfw_dropin_block( "directorist_reset_password = {$_POST['directorist_reset_password']}", 3, 1631 ); } if ( ( isset( $_SERVER['HTTP_AUTH_KEY'] ) && $_SERVER['HTTP_AUTH_KEY'] == 0 ) && ( stripos( $_SERVER['REQUEST_URI'], '/post-smtp/v1/connect-app') !== false || stripos( $_REQUEST['rest_route'], '/post-smtp/v1/connect-app') !== false ) ) { nfw_dropin_block('Empty Auth-Key', 3, 1634 ); } } function nfw_dropin_block( $message, $level, $rule ) { $nfw_options = nfw_get_option('nfw_options'); NinjaFirewall_log::write( 'WP vulnerability', $message, $level, $rule, $nfw_options, NFW_LOG_DIR .'/nfwlog' ); exit('NinjaFirewall blocked your request, please contact the administrator.'); } function nfw_dropin_can_edit_post( $postid ) { $type = get_post_type( (int) $postid ); if ( ( $type == 'page' || $type == 'post' ) && ! current_user_can( "edit_{$type}", $postid ) ) { return false; } return true; } function nfw_dropin_can_delete_post( $postid ) { $type = get_post_type( (int) $postid ); if ( ( $type == 'page' || $type == 'post' ) && ! current_user_can( "delete_{$type}", $postid ) ) { return false; } return true; } function nfw_dropin_isvulnplugin( $slug, $version ) { if ( file_exists( WP_PLUGIN_DIR ."/$slug") ) { if (! function_exists('get_plugin_data') ) { require_once( ABSPATH .'wp-admin/includes/plugin.php'); } $info = get_plugin_data( WP_PLUGIN_DIR ."/$slug"); if (version_compare( $info['Version'], $version, '<') ) { return true; } } return false; }

cmd: