Whoops, missed that trailing %, yeah. So, the one site I was working on they had uploaded the 2011.php script into the forums tmp/ directory. This script was being called externally for modifying the database rows. Still not sure how they got the file into there in the first place at this point.
Same file was found on two other servers, one in the includes directory and one in a directory completely outside the forum.
Last edited by Rick; 08/26/2012 6:52 PM.
