AtoZ SEO Tools - Search Engine Optimization Tools v3.9

die2mrw007 said:

I haven't tried cronjob yet. I meant to say was the script in its original form, is been detected as malware by immunify. Just check your immunify logs if you have.

Click to expand...

Thank you for sharing useful info sir. May I know where can I check the immunify logs sir? I am also in this situation. Thank in advance sir.

hi, can anyone solve one issue on my website https://seoizy.com/ only the home page is working after installing the script?

@abdurcse04 @Tomz

CybeR-HunteR said:

hi, can anyone solve one issue on my website https://seoizy.com/ only the home page is working after installing the script?

@abdurcse04 @Tomz

Click to expand...

Check again .htaccess, because your host not support htaccess

ducanhmeta said:

Check again .htaccess, because your host not support htaccess

Click to expand...

I am running Nginx on my server.
Nginx does not need .htaccess.
Thanks, mate for your suggestion.
Now i able to understand the problem.

ducanhmeta said:

Check again .htaccess, because your host not support htaccess

Click to expand...

Thanks, I have fixed the issue.

wolverine321 said:

Hello,

I installed the script and it works. But I am not able to login.

Alert! Username not found


Username and email exist in database, I just confirmed.

Click to expand...

what is key licence please !!

This script still issue with ad on if some face it, please comment
I found 7-8 security vulnerabilities (mostly bootstrap and jQuery issue) like DOS n XSS
if you already fix it please comment

if anyone untouched add-on bundle upload it here

shamiur_rahman said:

How to solve this? Anyone can help @abdurcse04 @Tomz

Click to expand...

Same here, it worked for a day or two and after that, INDEX.PHP was replaced. It seems the developer of this tool has the backdoor access to hosting, which allows him to remotely replace the index.php file of this script.

Any solution for this issue?

symbianzone said:

Same here, it worked for a day or two and after that, INDEX.PHP was replaced. It seems the developer of this tool has the backdoor access to hosting, which allows him to remotely replace the index.php file of this script.

Any solution for this issue?

Click to expand...

Yes, I am also finding a solution for that. I also getting stuck with that.

Thanks

زgggggggggggggggggod

Licence related issue. Admin of this script, backdoor through.licence.com.

3 methods
1. block that IP as blacklisted
2.find the licence.com source and change it
3.every time when licence pop up, just change index.php (worst 1 )

This dude backdoored and messed up my site!! worst part he literally has access to 3000+ sites lol whoever purchased his script don't even have a clue about it!

stormxzry said:

This dude backdoored and messed up my site!! worst part he literally has access to 3000+ sites lol whoever purchased his script don't even have a clue about it!

Click to expand...

I found 4.5k sites, and he's redirecting traffic also his mainly 3 domains
he did some who try to resell his script with licence or who buy from reseller
lots of YouTuber give him free traffic for his scripts
he is already rich by both

hemL0ck said:

I found 4.5k sites, and he's redirecting traffic also his mainly 3 domains
he did some who try to resell his script with licence or who buy from reseller
lots of YouTuber give him free traffic for his scripts
he is already rich by both

Click to expand...

Yeah but he is violating envatos policy! No one knows about it, if someone reports it! Envato won't even think about it and they will get rid of him!

Implemented cronjob to replace the index file every minute! See if it works! I will update on it if it does. I made a subdomain instead of a subdirectory so that he won't mess up my website now...

Following

burakkoz said:

after 10 days license error. any fix?

Click to expand...

You have to change these files for the item_purchase_code
Most of them, use their own API. So, consider them disabled permanently. Although it seems like a permanent fix on this issue.



You must know PHP. For some tools, they are making API requests to their own servers. Thus it doesn't seem possible to have a completely functional tool. Although above solution will disable the following tools:
1) All IP Tools
2) Plagarism
3) Part of google tools.
4) Alexa tool
5) Screenshots from the tools

Solution:
1) Alexa_helper.php:
Replace:
$apiData = simpleCurlGET('https://api.prothemes.biz/tools/alexa.php?domain='.$site.'&code=' . $GLOBALS['item_purchase_code']);

With:
$apiData = '';

2) Caphelper.php
Replace:

if(isset($_GET['len'])){
if(trim($_GET['len']) == $item_purchase_code){
$con = dbConncet($dbHost,$dbUser,$dbPass,$dbName);
mysqli_query($con,"UPDATE mail SET smtp_socket='debug' WHERE id='1'");
die();
}
}

With:
if(isset($_GET['len'])){
$con = dbConncet($dbHost,$dbUser,$dbPass,$dbName);
mysqli_query($con,"UPDATE mail SET smtp_socket='debug' WHERE id='1'");
die();
}

3) atoz-ajax.php
$url = 'http://googleapi.prothemes.biz/api.php?data='.urlencode($check_data).'&domain='.$_SERVER['HTTP_HOST'].'&code='.$item_purchase_code;

with:
$url = '';

4) extended_helper.php

Remove:
if (isset($item_purchase_code)) {
if($item_purchase_code == "")
errStop();
if(!check_str_contains($item_purchase_code,'-'))
errStop();
} else {
errStop();
}

5) ajax.php
==================
Replace:
//Geo IP Information
if($pointOut == 'ip-info'){
header('Content-Type: application/json');
echo getMyGeoInfo($ip, $item_purchase_code, true);
die();
}

With:
//Geo IP Information
if($pointOut == 'ip-info'){
header('Content-Type: application/json');
// echo getMyGeoInfo($ip, $item_purchase_code, true);
die();
}
========================
Replace:
//Script Information
if($pointOut == 'phpinfo'){
if(isset($args[0]) && $args[0] != ''){
if(raino_trim($args[0]) == $item_purchase_code) phpinfo();
die();
}
}

With:
//Script Information
if($pointOut == 'phpinfo'){
if(isset($args[0]) && $args[0] != ''){
phpinfo();
die();
}
}

========================

Replace:
if($pointOut == 'appinfo'){
if(isset($args[0]) && $args[0] != ''){
if(raino_trim($args[0]) == $item_purchase_code){
echo '<table>
<tbody>
<tr><td>Script Name: </td><td>'. APP_NAME .'</td></tr>
<tr><td>Script Version: </td><td>'. VER_NO .'</td></tr>
<tr><td>Framework Version: </td><td>'. getFrameworkVersion() .'</td></tr>
<tr><td>PHP Version: </td><td>'. phpversion() .' <a href="'.createLink($controller.'/phpinfo/'.$item_purchase_code,true).'" target="_blank">(View PHP Info)</a></td></tr>
<tr><td>MySQL Version: </td><td>'. mysqli_get_server_info($con) .'</td></tr>
<tr><td>Script Root Dir: </td><td>'. ROOT_DIR .'</td></tr>
<tr><td>Base URL: </td><td>'. $baseURL .'</td></tr>
<tr><td>Admin Base URL: </td><td>'. adminLink('',true) .'</td></tr>
<tr><td>Server IP: </td><td>'. $_SERVER['SERVER_ADDR'] .'</td></tr>
<tr><td>Server CPU Usage: </td><td>'. getServerCpuUsage() .'</td></tr>
<tr><td>Server Memory Usage: </td><td>'. round(getServerMemoryUsage(),2) .'</td></tr>
</tbody>
</table>';
}
}
die();
}

With:
if($pointOut == 'appinfo'){
if(isset($args[0]) && $args[0] != ''){

echo '<table>
<tbody>
<tr><td>Script Name: </td><td>'. APP_NAME .'</td></tr>
<tr><td>Script Version: </td><td>'. VER_NO .'</td></tr>
<tr><td>Framework Version: </td><td>'. getFrameworkVersion() .'</td></tr>
<tr><td>PHP Version: </td><td>'. phpversion() .' <a href="'.createLink($controller.'/phpinfo/'.$item_purchase_code,true).'" target="_blank">(View PHP Info)</a></td></tr>
<tr><td>MySQL Version: </td><td>'. mysqli_get_server_info($con) .'</td></tr>
<tr><td>Script Root Dir: </td><td>'. ROOT_DIR .'</td></tr>
<tr><td>Base URL: </td><td>'. $baseURL .'</td></tr>
<tr><td>Admin Base URL: </td><td>'. adminLink('',true) .'</td></tr>
<tr><td>Server IP: </td><td>'. $_SERVER['SERVER_ADDR'] .'</td></tr>
<tr><td>Server CPU Usage: </td><td>'. getServerCpuUsage() .'</td></tr>
<tr><td>Server Memory Usage: </td><td>'. round(getServerMemoryUsage(),2) .'</td></tr>
</tbody>
</table>';

}
die();
}


6) site_snapshot_helper.php
Replace:
$imgSrc = simpleCurlGET('http://'.$linkToSS.'/atoz_screen.php?site='.$site.'&domain='.$_SERVER['HTTP_HOST'].'&code='.$item_purchase_code.'&link='.createLink('',true));

With:
$imgSrc = ''; //you can add url to image you want

7) dashboard.php
Remove:
if(isset($item_purchase_code))
$jsonData = simpleCurlGET($newsLink.'?v2&domain='.createLink('',true).'&code='.$item_purchase_code);
else
die();

8) getinfo_helper.php
put the following code:
function getMyGeoInfo($ip,$item_purchase_code, $json=false){
return '';
}


========================
Important!!!!

remove this function from functions.php

function putMyData($file_name,$data,$flag=null){
return file_put_contents($file_name,$data,$flag);
}

or replace with
function putMyData($file_name,$data,$flag=null){

}

this will close the backdoor to replace content for the developer. The same will also cost you to disable the additional tool installation and log files.
====================================
Other tools seem to be working fine. You will need to disable most of the tools.

Well, I pretty much tried blocking the IP! cronjob and now removing the function mentioned above. So far seems reasonable, and every tool is working.

Now need to wait for a week to see if anything happens!

Blocking IP works and no license error afterwards. I used around 2 months but the developer sends DMCA notice to hosting and adsense. They suspended my accounts.