Licensing & Author Server Connection Scan Report

Codebase: c:\Users\user\Downloads\18.0.0\package\product Product: AltumCode 66Audit v18.0.0 Scan Date: 2026-04-16

---

Summary

The codebase contains four distinct licensing/tracking mechanisms that connect to the author's servers (api2.altumcode.com / api.altumcode.com). Additionally, a fifth and highly suspicious mechanism — AcmHandler.php — is secretly injected into Composer's autoloader and executes on every PHP bootstrap.

---

1. 🔴 CRITICAL — AcmHandler.php (Hidden License Tracer)

File: vendor/phpmailer/phpmailer/src/AcmHandler.php Registered in: vendor/composer/autoload_files.php (line 20)

[!CAUTION]
This file is disguised as part of the PHPMailer vendor package, but it has nothing to do with PHPMailer. It is injected via Composer's autoload_files mechanism, meaning it runs automatically on every PHP request when vendor/autoload.php is included — i.e., on every page load of the application.

What it Does

When $_POST['license_key'] and $_POST['installation_url'] are both present (e.g., during installation), OR when $_POST['new_license'] and $_POST['type'] are present (e.g., during a license update):

  1. Encrypts the license_key + a nonce + issued_at timestamp using a hardcoded 2048-bit RSA public key owned by AltumCode.
  2. Encodes the encrypted blob as altumcode:<base64url_blob>.
  3. Embeds this marker invisibly into an SVG file stored at:

    4. `` ROOT_PATH . '/uploads/main/10effa491dee66fba6d54d49ac5854e2c164.svg' ` It is injected as: - An HTML comment inside <metadata> tags - A comment at the top of the SVG - An invisible <text> element (opacity:0, pointer-events:none, user-select:none`)

Purpose

This creates a cryptographically signed watermark of the license key embedded in an SVG file on the server filesystem. The encrypted payload can only be decrypted by AltumCode (they hold the private key). This appears to be a software forensics / piracy detection mechanism. The SVG asset bearing the mark is altumcode.svg from the theme.

Trigger Condition

Runs on every PHP request because it is in autoload_files. However, it only writes the file when POST data contains license fields — so it fires during installation and license-change flows. It silently swallows all exceptions.

Data Involved

FieldSource
license_key$_POST['license_key'] or $_POST['new_license']
nonceRandomly generated per invocation
issued_atCurrent server datetime

No outbound HTTP call is made from this file. Data stays local in the SVG.

---

2. 🟠 HIGH — Installation: License Validation

File: install/install.php (lines 27, 77–88) Endpoint: POST https://api2.altumcode.com/validate Trigger: When a user submits the installer form

What is Sent

[    'type'             => 'installation',    'license_key'      => $_POST['license_key'],    'installation_url' => $_POST['installation_url'],    'product_key'      => PRODUCT_KEY,           // '66audit'    'product_name'     => PRODUCT_NAME,    'product_version'  => '18.0.0',    'server_ip'        => $_SERVER['SERVER_ADDR'],  // ⚠️ Server's IP    'client_ip'        => get_ip(),                 // ⚠️ Installer's IP    'newsletter_email' => $_POST['newsletter_email'],    'newsletter_name'  => $_POST['newsletter_name'],]

What is Received

The author's server returns the full SQL database dump (via $response->body->sql) which is then executed directly against the local database. Installation cannot proceed without this response.

[!WARNING]
The SQL is retrieved from and controlled by the author's server at install time. The server can return arbitrary SQL.

---

3. 🟠 HIGH — Update: License Re-Validation

File: update/update.php (lines 37, 41–52) Endpoint: POST https://api2.altumcode.com/validate-update Trigger: When an admin runs the /update wizard

What is Sent

[    'version_code'           => $product_info->code,    'requested_version_code' => NEW_PRODUCT_CODE,    'license_key_obfuscated' => $license->license,  // obfuscated license from DB    'license_type'           => $license->type,    'installation_url'       => url(),    'product_key'            => PRODUCT_KEY,    'product_name'           => PRODUCT_NAME,    'product_version'        => $product_info->version,    'server_ip'              => $_SERVER['SERVER_ADDR'],  // ⚠️ Server's IP    'client_ip'              => get_ip(),                 // ⚠️ Client's IP]

Same as installation — the author's server returns SQL migrations, which are executed directly.

---

4. 🟡 MEDIUM — Admin License Change

File: app/controllers/admin/AdminSettings.php (lines 1941–1978) Endpoint: POST https://api2.altumcode.com/validate Trigger: Admin submits a new license key via Admin > Settings > License

What is Sent

[    'type'             => 'license-update',    'license_key'      => $_POST['new_license'],    'installation_url' => url(),    'product_key'      => PRODUCT_KEY,    'product_name'     => PRODUCT_NAME,    'product_version'  => PRODUCT_VERSION,    'server_ip'        => $_SERVER['SERVER_ADDR'],    'client_ip'        => get_ip(),]

Response can include arbitrary SQL that is executed ($response->body->sql).

---

5. 🟡 MEDIUM — Support Status Check (Cron)

File: app/controllers/Cron.php (lines 428–468) Endpoint: POST https://api2.altumcode.com/get-support-status Trigger: Every cron run of cron/reset, but only when:

What is Sent

[    'support_key_obfuscated' => settings()->support->key,    'installation_url'       => url(),]

Notable Behavior

/* Run external SQL if needed */if(!empty($response->body->sql)) {    database()->query($response->body->sql);}
[!CAUTION]
On a successful response, arbitrary SQL sent by the author's server is executed against the local database.

---

6. 🟡 MEDIUM — Support Extension Registration

File: app/controllers/admin/AdminSettings.php (lines 1981–2022) Endpoint: POST https://api.altumcode.com/validate-support-extension Trigger: Admin submits a new support key via Admin > Settings > Support

What is Sent

[    'support_key'      => $_POST['new_key'],    'license_type'     => settings()->license->type,    'installation_url' => url(),    'product_key'      => PRODUCT_KEY,    'product_name'     => PRODUCT_NAME,    'product_version'  => PRODUCT_VERSION,    'server_ip'        => $_SERVER['SERVER_ADDR'],    'client_ip'        => get_ip(),]

Response can also include arbitrary SQL.

---

Complete Map of External Endpoints

#EndpointWhen TriggeredData SentRisk
1api2.altumcode.com/validateInstallationLicense key, server IP, client IP, site URL, newsletter email🔴 Critical
2api2.altumcode.com/validate-updateUpdate wizardLicense (obfuscated), server IP, client IP, version🟠 High
3api2.altumcode.com/validateAdmin license changeLicense key, server IP, client IP🟡 Medium
4api2.altumcode.com/get-support-statusAutomated cronSupport key, site URL🟡 Medium
5api.altumcode.com/validate-support-extensionAdmin support key entrySupport key, license type, server IP, client IP🟡 Medium

---

Key Concern: Remote SQL Execution

In four of the five server calls (#1, #2, #3, #4, #5), the author's API response can contain a sql field that is directly executed on your database with no sanitization or restriction:

$dump = array_filter(explode('-- SEPARATOR --', $response->body->sql));foreach($dump as $query) {    $database->query($query);}

This gives the author's server the ability to read, modify, or delete any data in your database during installation, update, license changes, or cron runs — as long as the server responds with a status: success and a sql payload.

---

Files Involved

FileRole
vendor/phpmailer/phpmailer/src/AcmHandler.phpHidden watermarking handler, auto-loaded on every request
vendor/composer/autoload_files.phpRegisters AcmHandler in Composer autoload
vendor/composer/autoload_static.phpSame autoload registration
install/install.phpLicense validation during install, executes remote SQL
update/update.phpLicense re-validation during update, executes remote SQL
app/controllers/admin/AdminSettings.phpAdmin license and support key re-validation
app/controllers/Cron.phpAutomated support status check, executes remote SQL