new patterns

cms-ver.php

@@ -163,9 +163,12 @@
         array("phpMyAdmin", "/libraries/defines.lib.php", "define('PMA_VERSION',", "Not Allowed"),
         array("phpMyAdmin", "/libraries/Config.php", "\$this->set('PMA_VERSION',", "Not Allowed"),
         array("phpMyAdmin", "/libraries/Config.class.php", "\$this->set('PMA_VERSION',", "Not Allowed"),
-        array("CubeCart", "/ini.inc.php", "define('CC_VERSION',", "Maintained"), 
+        array("CubeCart", "/ini.inc.php", "define('CC_VERSION',", "Maintained"),
         array("Simple PHP Blog", "/scripts/sb_functions.php", "\$sb_info[ 'version' ] =", "EOL"),
-
+        array("Claroline", "/inc/installedVersion.inc.php", "\$new_version =", "EOL"),
+        array("Moodle", "/version.php", "\$release  =", "Maintained"),
+        array("WebAsyst", "/kernel/wbs.xml", "<WBS VERSION=", "EOL"),
+        
 // still need to work on these
     array("Silverstripe", "/cms/silverstripe_version", "*"), //needs review
     array("Croogo", "/Vendor/croogo/croogo/VERSION.txt", "*"), // needs further review

malware6.pl

@@ -35,6 +35,7 @@ my @regexen = (
     qr/<\?php\s+if \(!isset\(\$sRetry\)\).+?\$stCurlLink = base64_decode\(.+?curl_close\(\$stCurlHandle\);.+?\?>/is,
     qr/eval\(\"\?\>\" \. base64_decode\(.+?\)\); \?>/is,
     qr/<\?php.+?\$alphabet =.+?exit\(\);.+?\$([A-z0-9]{1,20}) =.+?\"\"\.chr\(.+?\)\.\"\"\.chr\(.+?\)\.\"\\x.+?\]\.\$([A-z0-9]{1,20})\[\d\d\], \$([A-z0-9]{1,20})  ,\"([A-z0-9]{1,20})\"\);/is,
+    qr/<\? echo\(base64_decode\(.+?\)\);  \?>/is,
 
 );
 

malwaresh.pl

@@ -1019,7 +1019,7 @@ my @regexen = (
     qr/<\?php\s+if \(!isset\(\$sRetry\)\).+?\$stCurlLink = base64_decode\(.+?curl_close\(\$stCurlHandle\)\;.+?\?>/is,
     qr/eval\(\"\?\>\" \. base64_decode\(.+?\)\); \?>/is,
     qr/<\?php.+?\$alphabet =.+?exit\(\);.+?\$([A-z0-9]{1,20}) =.+?\"\"\.chr\(.+?\)\.\"\"\.chr\(.+?\)\.\"\\x.+?\]\.\$([A-z0-9]{1,20})\[\d\d\], \$([A-z0-9]{1,20})  ,\"([A-z0-9]{1,20})\"\);/is,
-
+    qr/<\? echo\(base64_decode\(.+?\)\);  \?>/is,
 
 );